Fake M&A / Legal 'Confidential Wire' BEC
A scammer poses as an executive and an 'attorney' handling a secret acquisition or legal matter, pressuring an employee to wire large funds confidentially and fast.
Think a message like this reached you? You can check it right now.
What this scam is
A more elaborate BEC: the 'CEO' emails that a confidential acquisition, legal settlement, or regulatory matter requires an urgent wire, and hands you off to an 'attorney' or 'law firm' who supplies wire instructions and reinforces the secrecy and urgency. The added authority of a lawyer and the sensitivity of a 'deal' make employees comply without normal checks. The wire goes to the fraudster. Independent verification of the executive and any lawyer, via known contacts, defeats it.
What it usually looks like
- An 'executive' citing a confidential acquisition/legal matter.
- Hand-off to an 'attorney/law firm' with wire instructions.
- Heavy emphasis on secrecy and speed.
- Large wire amounts.
Common warning signs
- Confidential, urgent wires tied to a 'deal.'
- An unfamiliar 'attorney' providing wire details.
- Pressure to bypass normal approvals.
- Secrecy that prevents verification.
Example wording scammers use
“We're closing a confidential acquisition. Our attorney will send wire details — please execute today and discuss with no one.”
“(From 'attorney') Per Mr. X, wire the escrow amount to the account below to close the deal.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- A large, urgent, confidential wire.
- To exploit authority and secrecy.
- To bypass approval controls.
What to do
- Verify the executive and any attorney independently via known contacts before wiring.
- Enforce multi-person approval and callbacks for large wires — no exceptions for 'confidential deals.'
- Treat secrecy + urgency + wire as a fraud signature.
- Escalate to security.
What to do if you already responded
- Contact your bank immediately for a recall; time is critical.
- Report to the FBI at ic3.gov right away.
- Alert leadership/security and report at reportfraud.ftc.gov.