Business Email Compromise · Federal Wire Fraud
How Is Business Email Compromise Proved?
Trace the disputed email, payment instruction, transfer, and account access to assess each person’s role and knowledge.
Eligible to Practice in Texas
Attorney at Law
Bar Card Number: 00796807
TX License Date: 11/01/1996
214 Connally St Ste A
Sulphur Spgs, TX 75482-2612
A vendor sends an invoice. The customer then receives a request to pay a different account. The review has to distinguish a genuine change from a message sent through a stolen mailbox or made to look as though it came from the vendor. What the customer received, what someone approved, and where the money went all need to be compared. The name displayed on an email or bank account does not establish who acted.
What must the prosecution prove?
For a charge under 18 U.S.C. § 1343, federal prosecutors must prove:
- A fraudulent scheme.
- The required intent.
- An interstate or foreign wire used to carry out the scheme.
The records must also establish the accused person’s role and knowledge.
Preserve records without changing the evidence
Keep the evidence in its original available form. For every export, record who collected it, the collection date, and the settings used. Those details allow another reviewer to check the collection. Preserve the following material:
- Save complete mailbox exports with their headers and attachments.
- For access activity, retain the available audit and authentication logs.
- Collect the bank statements and the wire confirmations.
- Retain the recall requests and the beneficiary-account records.
- Keep relevant device and cloud data. Include forwarding rules and recovery history.
Before anyone resets the system or deletes material, preserve the evidence. Continuing unauthorized access also needs attention: a qualified technical professional should secure the system while retaining that evidence. Keep a record of the actions taken so a later reviewer can account for the changes.
From the invoice to the receiving account
A forwarded copy or screenshot may leave out the routing information needed to assess the sender. Go back to the email as it reached the recipient, with its headers and attachments. Keep a note of where that original came from and how it was collected; another reviewer needs to be able to check the collection.
- Compare the displayed name and address with the message’s technical fields.
- Check for a lookalike domain or a changed reply-to address.
- Consider whether the genuine mailbox was used.
The table organizes the records around the disputed instruction. It is not a timeline. Email time, bank posting, settlement, and availability of funds describe four different events; neither the table’s order nor the time of one event establishes when the others occurred.
| Event question | Records and comparison |
|---|---|
| What request reached the customer? | Put the genuine invoice beside the disputed payment request. Compare the vendor’s usual account with the replacement account, and identify who received the request. |
| Who approved the payment? | Follow the instruction from receipt to payment approval. Identify the person who approved it. Check whether anyone verified the change through a trusted separate channel. |
| Which transfer is linked to the instruction? | Compare the instruction with the transfer’s amount and destination, routing details, processing bank, and receiving account. |
| When did the bank post, settle, and make funds available? | Keep the posting, settlement, and availability-of-funds entries distinct from the email time. These are different events. |
| What happened to a recall or recovery? | Keep a recall request with the bank’s response. Account separately for money returned, money recovered, and money still unpaid. Those amounts do not answer whether the government can prove the scheme and intent. |
Compare timing and access without assuming identity
An address on the screen does not reveal who was at the keyboard. Access around the time of the disputed message needs to be compared with the message itself. Look for evidence supporting use of the genuine mailbox or a spoofing explanation. The following checks address access; by themselves, they do not identify the sender.
| Records to examine | Comparison and limits |
|---|---|
| Message and login times | Compare the available message-header timestamps with the login timestamps. Keep each recorded time zone beside its entry and note any missing zone. Do not silently supply a missing time zone. The records may use different clocks; their apparent sequence alone does not identify the sender. |
| Collection and clock reliability | Check the collection history. Record uncertainty about clock accuracy or the authenticity of the message header. |
| Login and authentication activity | Review logins around the disputed email alongside multifactor authentication, IP address and device records. Establish whether the device was shared. |
| Mailbox settings | Look for changed recovery settings and new forwarding rules. |
| Domain records | Check domain-registration and hosting records for support for a spoofing explanation. |
Who controlled the receiving account?
- Who opened the account?
- Who could use it?
- Who directed a withdrawal?
The account holder’s explanation has to be checked against the account-opening and identity records, ownership information, access logs, and communications. A quick withdrawal may be relevant to that review. It does not establish that the holder wrote the email or knew about the scheme before the money arrived.
What did each person know at the time?
Give each person named in the charge a separate timeline of the messages, payment changes, approvals, and transfers attributed to that person. The question beside each act is what the evidence shows the person knew beforehand. What a person learned later does not establish what they knew before an act. A transfer charged as laundering also needs analysis under the statute for that count.
Give counsel the separate timelines and identify the gaps in the records. Do not fill those gaps with assumptions about who sent the message, approved the payment, or received it. Leave those questions open where the records do not answer them. Counsel can assess what is missing against the allegations and the law for the charged dates.
Sources
This guide discusses evidence in business email compromise cases. It does not provide legal advice for an individual matter. A specific matter requires review of its charging instrument, offense dates, and underlying records. Representation begins only after the firm agrees to take the matter.
