Create the verification channel before closing pressure rises
A business sale can involve a large buyer payment, an escrow account, debt payoffs, fees, and distributions to several sellers. The transaction team should agree in advance how bank instructions and changes will be authenticated. A message appearing inside a familiar email thread does not independently establish that the real recipient authorized a new account.
The FBI’s published business-email-compromise guidance describes compromised legitimate accounts as well as spoofed addresses. Its March 2021 notification, written about government victims, recommends verifying payment changes in person or through a known telephone number and using contact information already on file. Those verification principles are useful to a business-sale team handling a high-value closing payment.
Create a verified contact list through the parties’ established channels before the final funding day. Identify the people authorized to request and approve changes, the accounts expected to receive funds, and the process for pausing a disputed instruction. A telephone number supplied in the same unexpected message should not become the independent confirmation channel by default.
Reconcile every destination with the signed closing schedule
Prepare a payment schedule identifying the legal recipient, purpose, amount, account-verification status, and required authorization for each wire. Distinguish buyer funding into escrow from escrow’s later payments and the seller’s own transfers after receipt. The same set of commercial proceeds can create several separate opportunities for an instruction change.
Consider a hypothetical $5,000,000 cash closing with $1,200,000 to a lender,$300,000 to transaction and escrow obligations, and $3,500,000 remaining for sellers before their taxes and other uses. If fraudulent instructions divert the $1,200,000 payoff, the lender obligation does not disappear merely because money left an account. Counsel and the bank must address the actual consequences and recovery process.
The illustration is a payment reconciliation, not a determination of who bears a particular fraud loss. It shows why each destination needs verification. Confirm the actual recipient and authority rather than treating the total amount wired as proof that the closing uses were satisfied. A settlement statement can be arithmetically correct while a payment follows unauthorized instructions.
Make changes deliberate and reviewable
A practical team protocol can require an independent callback, documented approval by the responsible closing personnel, and a reconciled revised payment schedule before any changed instruction is used. Establish the process with the bank, escrow agent, and counsel using their actual capabilities and requirements. This article does not claim that a particular two-person protocol is mandated by law for every sale.
Treat unexplained urgency, a new communication platform, unexpected secrecy, or a last-minute account change as reasons to pause and verify. Do not assume a small test transfer proves the recipient’s legal authority or protects the later balance. The actual instruction and identity still need the agreed review.
Suppose the team needs an additional thirty minutes to complete a supported verification while the closing schedule has a same-day funding cutoff. Compare that timing issue with the risk of sending the entire principal on an unverified change. Have counsel and the closing agent address any resulting deadline or extension rather than letting an email claiming immediate urgency override the agreed verification process.
Preserve evidence and coordinate the response
If the team suspects a fraudulent transfer, contact the bank and responsible closing professionals promptly through established channels and obtain current reporting and response instructions. The FBI resource identifies reporting through IC3 and law-enforcement channels. Recovery is not guaranteed, and a historical case involving recovered funds should not be used as a promise that the same result will occur.
Preserve the original messages, headers where available, instruction versions, approvals, bank confirmations, timestamps, recipient details, and relevant access information for the response team. Coordinate with the organization’s security personnel so an ongoing account compromise is investigated rather than merely sending another message through the same potentially affected account.
This guide does not assign liability, prescribe a bank recovery procedure, or certify that any payment is safe. Its practical exit decision is to establish and use independent verification before the closing wire changes direction. That gives the business-sale team a clear way to resolve payment instructions under time pressure and helps ensure the supported proceeds schedule corresponds to the money’s actual destinations.
Sources & further reading
Consult the original guidance and its effective dates. These references support the educational discussion; their application depends on the specific facts.