Reconstruct the email trail behind a diverted payment
A wire fraud investigation examines how a fraudulent payment instruction reached the person who acted on it. Forensic Discovery helps counsel and finance leaders compare messages, account activity, invoice changes, and approval records after a suspected business email compromise (BEC) or impersonation.
Our digital forensics services help distinguish evidence of sender spoofing from evidence of mailbox access and build a timeline of the available records. The work may clarify which account was affected, what changed, and where the evidence leaves questions unanswered.

Findings can support counsel’s recovery efforts, a bank recall request, an insurance claim, or a law enforcement report. Forensic Discovery does not recover funds, trace money through the banking system, or guarantee identification of a perpetrator.
Discuss your wire fraud investigationTypes of wire fraud and business email compromise we examine

Business email compromise investigations
A real conversation can conceal an unauthorized participant. We compare the thread with available mailbox activity, rules, and authentication records to examine whether an account was accessed and how the payment request developed. Phishing is one possible entry route, not an assumption. Our article on wire fraud and email conversation hijacking scams explains this scenario.
Vendor impersonation and invoice payment diversion
A message may imitate a familiar supplier while changing the reply address, invoice, or bank instructions. We compare available native messages and document versions with the legitimate correspondence. A lookalike domain can support an impersonation explanation without establishing that either party’s mailbox was compromised.
Real estate closing and escrow wire fraud
Closing instructions can move among buyers, brokers, counsel, title companies, and escrow staff. We reconstruct the available communications and changes to payment details. Identifying gaps between participants’ records matters: one party’s mailbox alone may not explain what another party received or acted on.
Executive impersonation and payroll diversion
An urgent executive request or change to direct deposits may arrive from an imitation address or an accessed account. We compare messages, available sign-in activity, and approval records to establish the documented sequence. A display name or account label does not establish who sent the request.
Disputes over whose email was compromised
When each party points to the other, counsel needs findings grounded in records rather than assumptions about responsibility. We examine the authorized sources, compare competing explanations, and identify records needed from the other side. Access to another party’s data requires appropriate authority; available evidence may not resolve every question.
When to bring in a wire fraud investigation team
A bank, insurer, or agency needs a factual account
Payment confirmations show a transaction, but may not explain the email that prompted it. A documented timeline can connect the instruction, changes, approvals, and available account activity. We discuss the intended recipient and requested records with counsel so the findings package addresses the relevant questions. The bank, insurer, or agency determines its own requirements and response.
You need to understand the scope of account activity
A suspicious sign-in or hidden forwarding rule raises questions about which mailboxes and communications were affected. We assess the available evidence of access and activity within the agreed period. Log coverage, permissions, licensing, and retention limit what can be established. A missing event does not show that access never occurred or that every affected message has been identified.
Counsel is evaluating a dispute over the loss
Technical findings can address the origin and sequence of messages, changes to instructions, and the records available to each party. We document contrary evidence and alternative explanations alongside supported conclusions. Counsel evaluates duties, claims, and responsibility; the forensic examination does not decide who bears the loss or whether a payment instruction should legally have been detected.
Signs that warrant closer examination
- An unexpected transfer request or unusual urgency.
- A changed reply address, contact detail, or domain spelling.
- Bank instructions received at the last minute that differ from earlier records.
- A payment destination the genuine counterparty does not recognize.
- No acknowledgment from the expected recipient after payment.
These are reasons to check the records, not proof of fraud. Containment belongs to your IT or security provider and should be coordinated with preservation where feasible; our role is forensic reconstruction.
When employee involvement needs broader examination
If suspected employee involvement requires a broader review of digital records, see employee misconduct investigations and our article on investigating potential employee misconduct and fraud.
Email, account, and payment records we examine
Sources are selected for the questions in dispute and the authority available. Examples below describe possible evidence, not findings promised in every matter.
| Record | Question it can help answer | Interpretation limit |
|---|---|---|
| Native messages, headers, and conversation threads | Did sender, reply address, routing, or payment wording change? | Forwarded copies may omit headers; authentication results do not identify a person. |
| Mailbox audit and sign-in records | What access or recorded mailbox activity occurred near the request? | IP address, device, and location fields need context and corroboration. |
| Inbox rules, forwarding settings, and application consents | Could messages have been redirected, hidden, or accessed through an application? | Current settings may differ from historical settings; authorization is a separate question. |
| The payment approver’s workstation | What relevant local messages, attachments, or browser artifacts remain? | Artifact availability and collection scope constrain reconstruction. |
| Invoices and vendor master records | When did payment details or document versions change? | Metadata alone does not establish the editor or intent. |
| Approval communications and wire confirmations | How do the documented instruction, approval, and transfer times align? | Time zones and clock differences must be reconciled; these records do not trace subsequent funds. |
Related sources and services
Platform collection is covered by cloud-based forensics for Microsoft 365 and Google Workspace. For related source work, see forensically sound email collection and computer forensics examination of the approver’s workstation.
How our wire fraud investigation process works

- Define the questions. Counsel or finance describes the payment, relevant thread, parties, dates, and actions already taken. We agree on authorized sources and intended deliverables.
- Preserve available records. Collect agreed mailboxes, logs, files, and device evidence using methods appropriate to each source. Document chain of custody and hash verification where applicable. Counsel directs any broader hold; see data preservation and collection.
Integrity checks and their limits
Hash comparison can help verify that collected files remain unchanged; it does not establish that the source was complete or that a message was truthful.
- Examine messages and account activity. Compare headers, rules, sign-ins, and available application records. Our Microsoft 365 digital forensics collection and analysis article provides platform context.
- Reconstruct the timeline. Align communications, document changes, approvals, and payment records. Record time conversions, conflicting sources, alternative explanations, and gaps.
- Review and report. Explain supported findings and limitations with source references and exhibits. Separate observed events from inference and unresolved questions.
- Prepare the agreed findings package. Support counsel’s requested report, declaration, or testimony scope and the factual materials intended for the bank, insurer, or agency.
Reports, declarations, and testimony
The agreed report can include an account in plain language, event timeline, source references, relevant message or log exhibits, methods, and limitations. Declaration, deposition, and trial support are scoped separately through our expert witness and testimony services. Collected records can also move into eDiscovery services if the dispute requires review and production under counsel’s direction.
Discuss your wire fraud findings package
A clear record for counsel and finance leaders
Forensic Discovery connects the technical examination to the questions that prompted the engagement: what instruction arrived, what changed, and what the available sources support. We explain the basis for a conclusion and identify where additional records or another party’s cooperation could change the assessment.
Reports distinguish account activity from human attribution and spoofing from supported evidence of compromise. This gives counsel and business leaders a factual foundation for their next decisions without turning a forensic opinion into a promise about liability or outcome.
Who we work with
We work with internal legal teams and outside counsel, CFOs, controllers, accounts payable leaders, title and escrow companies, brokerages, and businesses whose payment communications are disputed. Insurers can coordinate through counsel. See our digital forensics offices and service locations.
Forensic Discovery works with law firms and businesses only and does not accept direct individual consumer matters. If a law firm represents the individual, the firm may contact Forensic Discovery about the matter.
Scoping and pricing
Ask for the proposed scope, deliverables, assumptions and pricing in writing before authorizing work. Key factors include mailbox and tenant counts, whether one or both parties’ records are available, the relevant period, log retention, device examination, requested deadline, and anticipated reporting or testimony. We identify collection gaps and access dependencies during scoping so you can evaluate the proposed work and its limits.
Frequently asked questions about wire fraud investigations
What does a wire fraud investigation determine?
It reconstructs the available record of the instruction, communications, account activity, and payment approvals. Findings may support an explanation of spoofing, account access, or document changes. They may also leave important questions unresolved. The work does not automatically establish the sender’s identity, intent, or legal responsibility, and it does not show where funds moved after the documented transfer.
Can you recover the money that was wired?
No. Forensic Discovery does not recover funds or trace them through the banking system. Contact your bank promptly about its response options and coordinate with counsel and law enforcement as appropriate. Our findings can supply a factual account for those efforts or an insurance claim, but we cannot promise a recall, reimbursement, coverage decision, or other outcome.
How can you tell which party’s email was compromised?
We compare native headers, conversation records, available sign-ins, mailbox audit events, and rules. The comparison may distinguish an imitation sender from evidence of account access. One side’s records may be insufficient; examining another party’s sources requires appropriate authority. An IP address or account event alone does not identify a person, and absent logs cannot rule out compromise.
How is business email compromise different from phishing?
Phishing is a deceptive message used to induce an action, such as disclosing credentials. BEC describes schemes that abuse business communications, often to divert payments, using compromised accounts or impersonation. A phishing message can be an entry point, but a fraudulent instruction does not by itself establish phishing or mailbox access. The investigation tests those explanations against the available evidence.
Our IT team reset passwords and removed a rule. Is it too late?
Not necessarily. Relevant messages, exported records, logs, or device artifacts may remain, but changes can affect what is available. Bring in an examiner early to assess the remaining sources and document actions already taken. Do not assume a current mailbox configuration shows its earlier state. Missing or expired records should be disclosed as limitations rather than filled with assumptions.
How quickly should a wire fraud investigation start?
Prompt scoping helps identify records that may expire or change. Bank response processes have their own timing, so contact the bank without waiting for a completed forensic report. Counsel and the technical team can coordinate source priorities and authority. Availability, retention, source volume, and access affect the work schedule; we confirm the feasible scope and timing rather than promise a fixed turnaround.
Can findings support a bank request, insurance claim, or FBI IC3 report?
A scoped report can document the communications, relevant events, and exhibits for counsel to use with those recipients. Each recipient decides what it needs and how it evaluates the material. An investigation does not replace a bank’s response process, an insurance policy review, or a report to law enforcement. Agree on the intended use and available records when scoping the engagement.
How much does a wire fraud investigation cost?
The proposed cost depends on the number of mailboxes and tenants, source access, log coverage, the period examined, device work, deadlines, and deliverables. Comparing both sides of a disputed conversation can add sources and coordination. Ask for the proposed scope, deliverables, assumptions and pricing in writing before authorizing work. We address additional work if new evidence changes the questions. There is no universal price for every diverted payment.
Will the findings hold up in a lawsuit over the loss?
Documented collection, chain of custody, explained methods, source references, and candid limitations can support evaluation of the findings. They do not guarantee admissibility, evidentiary weight, or success. Counsel assesses the legal issues and the court decides admissibility. The judge or jury, as applicable, evaluates evidentiary weight. The report should make clear what was observed, what was inferred, and which conclusions the available record cannot support.
Do you provide expert testimony in BEC disputes?
Reports, declarations, deposition support, and trial testimony can be included in an agreed engagement. Our expert witness and testimony services address the technical findings and their basis. Counsel determines the legal presentation; the examiner’s role is to provide an independent technical opinion within their qualifications and the limits of the evidence. Engagement does not guarantee expert qualification, admissibility, or a particular result.
Schedule a Free Consultation
Tell us about the wire, the disputed email thread, and the steps already taken. We can discuss the questions, authorized sources, and scope for a wire fraud investigation. Call (866) 458-4993 or contact Forensic Discovery.
Use the form for a general inquiry; arrange an appropriate transfer method before sharing evidence or sensitive matter details.
"*" indicates required fields