Key points
- Wire fraud often targets an investor about to fund a subscription, using a fake email that names a new account.
- A US federal crime report counted about $2.77 billion in reported losses from this kind of email fraud in 2024.
- A five-point day-one notice says your wire instructions never change by email, and asks investors to call before a first wire.
- Two call-back examples and a sample payout change record show the routine.
- A wire is hard to get back. If money goes to the wrong account, call the sending bank at once.
It is the week before a funding date. An investor opens an email that seems to come from the fund. It says the fund changed banks and wants the wire today. What happens next depends on what the fund told that investor months ago.
How the fraud works
That email is a classic case of business email compromise. The sender address may be one letter off from yours, and the message pushes the investor to pay today. The urgency is the point, because it leaves no time to check. A US federal crime report for 2024 counted 21,442 such complaints and about $2.77 billion in reported losses.
Your defense has to be in place before that email arrives.
What to tell investors on day one
Investors can only spot a fake change if they know the real rules. Put these five points in your welcome letter, and repeat them before each funding date.
- Our wire instructions will never change by email.
- Our wire instructions are only in [name of secure portal].
- Before your first wire, call us at [phone number] to confirm. Do not use a phone number from any other message.
- If you get a message about new bank details, do not reply to it. Call us.
- Tell us when you send a wire. We will confirm when it arrives.
Point 4 is the one that gets tested.
Example (hypothetical). Say Fund A's next funding date is March 31. Investor A plans to wire $500,000 on March 27. On March 25, Investor A gets an email from an address one letter off from Fund A's. It says the fund changed banks and asks for the wire today.
Investor A follows point 4 and calls the number from the welcome letter. Fund A confirms that nothing changed. Fund A then warns its other investors before March 31, because the same fake email may have reached them. On March 27, Investor A wires $500,000 to the usual account and tells Fund A (point 5). Fund A confirms receipt on March 28.
How to share wire instructions
The notice only works if your habits match it. Instructions sent in an email body teach investors to trust email, the very channel the fraud uses. Share them through a secure portal instead.
A stable bank account helps too, because every change hands a criminal a believable story. If you must change it, tell investors well ahead of time, and ask them to confirm by calling you. Agree on a phone number with each investor in advance. You can also agree on a code word, because criminals can take over phone numbers.
Protect your own side
The same trick can target your team, to redirect a payout. The answer is a routine that no single email can override.
It starts at onboarding, when you collect each investor's payout bank details. After that, any change to them is high risk and is confirmed by phone on the number on file. Two people approve each payout. A message that says "urgent" skips none of these steps.
Scenario (hypothetical). Say Investor B has a $100,000 redemption due on June 30. On June 26, your team gets an email that looks like it is from Investor B. It asks you to send the redemption payment to a new bank account. Your analyst does not reply, and calls Investor B on the number already on file. Investor B never sent the email. Your team rejects the change. On June 30, you pay the $100,000 on schedule to the account on file.
Real changes need a trail too: one record per change to payout details, showing who asked, who called and who approved.
Sample: payout change record. This one shows a real change. The entries below are hypothetical.
| Step | Example entry |
|---|---|
| Request | Apr 2, email from Investor C (sender address checked: matches the one on file): pay a $250,000 redemption to a new account |
| Call-back number | The number on file from onboarding, not one in the email |
| Call result | Called by the operations analyst, Apr 2. Investor C confirms the request and reads out the new account's last four digits, 4821, which match the email. |
| Approver 1 | Operations lead, Apr 2 |
| Approver 2 | CFO, Apr 3 |
| Payout | $250,000 sent Apr 3 to the account ending 4821 |
If the investor did not ask for the change, the answer is the one Investor B's team gave: reject it and pay the redemption on schedule to the account on file. Then record the fake request, and tell the investor and your counsel.
If money goes to the wrong account
Even a good routine can fail. Wired money is hard to get back, so speed matters. Act in this order.
- Call the sending bank right away. Ask it to stop or reverse the wire.
- Report the fraud to law enforcement.
- Write down what happened and when.
- Tell your counsel and the affected investor.
Back to that investor. If the welcome letter did its job, the investor knew the instructions never change by email and had a number to call. One short call kept the wire safe.
This article is not legal advice.
Where Tahoe fits
That investor had to know where the real wire instructions live. We are building Tahoe to be that place, working alongside your administrator. Tahoe does not stop fraud, so your bank's checks and your call-back routine still matter.
- For a bank wire, the investor sees the fund's wire instructions inside the portal after signing in. The manager confirms when the money arrives.
- For a redemption like Investor B's, the manager reviews and approves the request, then signs to complete it.