Executive Impersonation and Wire Fraud: Who Bears the Business’s Loss?

On November 5, 2026, federal prosecutors in the Southern District of New York announced an indictment alleging technology-assisted voice and image impersonation of corporate executives and attorneys. Prosecutors attribute approximately $129 million in losses to the alleged scheme, including $2,968,497 allegedly lost by an unnamed California-headquartered hospital system. According to the announcement, employees received instructions concerning confidential transactions and were directed to purported attorneys who requested wire transfers. ¹

These are allegations, not established facts or civil liability findings. The defendants are presumed innocent unless and until proven guilty. The announcement does not establish that a particular employee or bank was negligent, or that a bank must reimburse an affected business. The California victim is not identified in the announcement. The criminal allegations and a business’s potential civil recovery require separate analysis. ¹

California Commercial Code § 11202(a) treats a payment order as authorized if the identified sender authorized it or is otherwise bound under agency law. Being deceived about a transaction’s purpose does not, by itself, answer whether the resulting instruction to the bank was authorized. ²

Hypothetical: A finance employee with authority to issue payment orders is deceived by someone impersonating the CEO and instructs the bank to send money. That differs from an outsider independently issuing payment instructions in the company’s name.

The employee’s actual authority, applicable agency principles, and the particular instructions matter. Not every employee-initiated transfer necessarily binds the company. Nor does violating an internal approval policy conclusively establish that the bank received an unauthorized order. Review the employee’s role, the account arrangements, and what was actually communicated to the bank. ²

Under § 11202(b), even an unauthorized order may be effective against the customer if the statutory requirements are met. These include an agreed, commercially reasonable security procedure and the bank’s proven good-faith compliance with that procedure and applicable instructions. A password’s use alone does not establish legally sufficient security; commercial reasonableness and compliance require their own analysis. Section 11202(c) addresses commercial reasonableness in light of the customer and circumstances. ²

Section 11203 may prevent enforcement of an otherwise effective unauthorized order, including where the customer proves its statutory conditions concerning the source of the compromise. Simply showing that an outsider committed fraud is insufficient. Section 11204 requires refunds for qualifying unauthorized-and-ineffective orders, or orders unenforceable under § 11203, to the extent the bank cannot enforce payment. These provisions do not guarantee reimbursement for every fraud-induced transfer, and contractual terms cannot override every statutory duty. ^{3 4}

California law does not automatically govern every transfer involving a California company. Applicable agreements and funds-transfer choice-of-law rules, including § 11507, require review. This discussion concerns commercial wire transfers, not consumer debit-card or other payment disputes. ⁵

The FBI’s business-email-compromise guidance recommends contacting the originating financial institution promptly to request a recall or reversal, and filing a detailed IC3 complaint, including banking information. ⁶

• Contact the originating bank immediately and request a recall or reversal; also ask for assistance contacting the receiving institution. • Submit a detailed report to the FBI’s Internet Crime Complaint Center. • Preserve original messages, available call records, payment instructions, approval records, bank confirmations, and relevant account agreements. • Review potentially applicable insurance and notice requirements promptly.

Receiving-bank assistance, preservation, and insurance review are practical recommendations. Recall requests, reporting, and insurance claims do not guarantee recovery. Evaluate notice and other requirements for the particular transaction rather than assume one deadline applies to every claim.

As a preventive practice, independently verify unusual payment requests through established contact channels. A convincing voice or video should not substitute for verification. Use previously established contact information rather than rely solely on details supplied with the new request.

Recovery analysis should distinguish the wrongdoer’s fraud from the separate duties of banks, recipients, and insurers. The account records, authorization evidence, governing agreements, and applicable law—not simply the apparent sophistication of an impersonation—help determine which claims and defenses warrant review.