BEC Wire Fraud Response Guide for Hospital Foundations: Protecting Donor Databases

How does business email compromise target hospital foundations?

Business email compromise (BEC) is a fraud scheme in which a criminal uses a spoofed or compromised email account to persuade someone to send money or disclose information. The message may imitate a foundation executive, hospital leader, board member, donor, vendor, or grant recipient. The FBI notes that BEC schemes commonly rely on impersonation, spear-phishing, or access to a legitimate email account to trigger an unauthorized transfer. See the FBI’s BEC guidance.

Foundations may be targeted with urgent requests to change a vendor’s bank details, redirect a grant payment, refund a donation, or send a wire before a deadline. A compromised mailbox can also give an attacker access to donor correspondence, payment discussions, and details that make a fraudulent request appear credible.

A wire-fraud incident and a donor-data incident are related but distinct. A fraudulent payment does not, by itself, prove that the donor database was accessed. However, an attacker who controls an employee’s mailbox may be able to search messages, access shared files, or use the account to reach other systems.

What should a foundation do immediately after a fraudulent wire transfer?

Act as soon as the transfer is discovered. Do not wait for a complete internal investigation or assume the payment can be reversed. Contact the originating bank’s fraud or wire department using a trusted phone number and ask it to contact the receiving bank immediately.

• Submit a wire recall request or request a reversal, and ask the bank whether it needs a hold-harmless letter or letter of indemnity.
• Provide the transaction date, amount, originating account, beneficiary name, receiving bank, account and routing details, and any reference or confirmation number.
• Ask the bank to document the report and explain what additional information or forms it needs. Keep a record of the time, contact, and case number for every call.
• Stop or review any other pending payments that may be tied to the same request or compromised account.

The FBI’s Internet Crime Complaint Center (IC3) advises contacting the originating financial institution as soon as fraud is recognized and requesting a recall or reversal. Fast action may reduce or prevent losses, but a recall is not guaranteed. See IC3’s BEC response guidance.

Notify the foundation’s executive leadership, finance team, IT or security staff, legal counsel, and relevant hospital contacts. Follow internal incident-response and cyber-insurance procedures, but do not let those steps delay contacting the bank.

How can you report wire fraud and request a recall?

Contact the bank first; filing a report does not replace a bank recall request. Then submit a detailed complaint to IC3, identifying the incident as business email compromise and including the transaction and banking information requested in the form.

If the wire is recent, the foundation can also contact its local FBI field office and provide the transaction details. The FBI has advised victims of recent fraudulent transfers to contact the financial institution immediately and reach out to the FBI; it may be able to assist with efforts to freeze or return funds, but no outcome is assured. See the FBI’s guidance for BEC and email-account-compromise victims.

Keep copies of the bank’s recall request, correspondence with the bank, the IC3 complaint confirmation, and any law-enforcement report or case number. IC3 complaints are analyzed and may be referred to law enforcement, but IC3 says it cannot respond to every complaint or provide updates on a specific complaint. Do not send original evidence to IC3 unless investigators request it; its FAQ on complaints and evidence says to retain originals securely.

How should staff contain a compromised email account and preserve evidence?

Have IT or a qualified incident-response provider secure the account from a known-clean device. Reset the password, revoke active sessions and suspicious authentication tokens, review multifactor-authentication methods, and check for unauthorized delegates, connected apps, mailbox rules, or changes to recovery information. If the account may have been used to access other systems, review those systems too.

Perform an email forwarding rule audit, including automatic forwarding, inbox rules, and any settings that redirect or silently delete messages. Remove unauthorized rules after recording what was found. Review sign-in and audit logs for unfamiliar locations, devices, IP addresses, mailbox access, and changes to security settings. CISA identifies external auto-forwarding as a way attackers can maintain access and exfiltrate email; see its Exchange Online security configuration guidance.

Preserve the original fraudulent message and any related messages in their original electronic form, with message header preservation. Save wire instructions, payment approvals, bank confirmations, relevant texts or chat messages, sign-in and mailbox logs, and a timeline of actions. Record who collected each item and when, and store the materials in a restricted, secure location. Do not delete the mailbox or forward suspicious messages in a way that alters or omits their headers.

IC3 recommends retaining original documents and emails, preferably electronic copies with full header information, along with wire receipts and relevant system logs. Its evidence guidance also says to keep originals securely because it does not accept attachments with complaints. For evidence handling and incident analysis, refer to NIST’s guide to integrating forensic techniques into incident response.

How can you assess donor database exposure and notification obligations?

Determine what the attacker could access—not only what the fraudulent email contained. Review mailbox access, search and download activity, shared-drive permissions, CRM sign-ins, exports, API connections, and access to payment or donor-management platforms. Identify the accounts and time period involved, the records potentially viewed or copied, and whether there is evidence of data transfer or misuse. If logs are incomplete, document that limitation rather than treating an absence of evidence as proof that no access occurred.

Inventory the donor personally identifiable information (PII) that may be involved, such as names, contact details, donation records, payment information, or other identifiers. Keep donor PII out of unsecured incident communications and limit access to staff who need it to investigate and respond.

Do not assume that every hospital foundation or donor record is covered by HIPAA. HIPAA applies to covered entities and business associates within the rule’s definitions; an organization’s relationship to the hospital and the work it performs matter. Donor information is not automatically protected health information merely because it is held by a hospital foundation. Check whether the foundation handled identifiable health information on behalf of a covered entity, whether it acted as a business associate, and whether a business associate agreement applies. HHS explains which organizations the HIPAA Rules cover in its guidance on covered entities and business associates.

If unsecured protected health information may have been involved, promptly involve the hospital’s privacy officer and counsel. Covered entities and business associates have specific duties under the HIPAA Breach Notification Rule, including a documented assessment of whether an impermissible use or disclosure constitutes a breach. Required notifications depend on the facts and the organization’s role; the federal rule calls for notice without unreasonable delay and sets an outside limit of 60 calendar days after discovery for individual notification. See HHS’s current Breach Notification Rule guidance.

Even when HIPAA does not apply, other obligations may arise under applicable state breach-notification laws, contracts, payment-card rules, insurance terms, or donor commitments. Ask counsel to assess the jurisdictions, types of information, affected individuals, and applicable deadlines before deciding whether and how to notify donors or regulators.

What payment controls help prevent future wire fraud?

Build payment procedures around the possibility that email may be spoofed or compromised. Require independent out-of-band payment verification for new payment instructions and any change to a beneficiary’s bank details. Verify using a trusted phone number already on file—not a number included in the change request—and confirm the recipient, account details, and purpose of the payment.

• Use wire transfer dual authorization so one employee initiates a transfer and a second authorized person reviews and approves it through a separate process.
• Require a documented callback and approval for new beneficiaries, changes to bank instructions, urgent exceptions, and unusually large or unusual payments.
• Restrict payment-system access to staff who need it, separate payment preparation from release, and review access and approval logs regularly.
• Use multifactor authentication for email and financial systems, and alert IT to unexpected sign-ins, mailbox-rule changes, and new forwarding destinations.
• Train staff to verify suspicious requests through a known channel, even when the email appears to come from a familiar executive, donor, or vendor.

IC3 specifically recommends using secondary channels or two-factor authentication to verify requests for changes in account information. These safeguards are risk-management practices, not a guarantee against fraud or a universal legal requirement. See IC3’s BEC prevention recommendations.

In short, a reliable response combines immediate bank contact, careful evidence preservation, a disciplined review of account and donor-data access, and payment controls that do not rely on email alone.

FAQs

How quickly should a hospital foundation contact its bank after a fraudulent wire transfer?

Immediately after discovering the fraud. Contact the originating bank’s fraud or wire department and request a recall or reversal, then ask it to contact the receiving bank. The sooner the bank receives the request, the better the chance of limiting loss, but recovery is not guaranteed. See IC3’s BEC guidance.

What evidence should be preserved after a BEC incident?

Preserve the original emails with full headers, wire instructions and receipts, bank confirmations, relevant messages and call records, mailbox and sign-in logs, and a timeline of events and response actions. Keep original files securely and document who collected them and when. IC3 lists examples of evidence to retain.

How can a foundation determine whether donor information was exposed?

Review mailbox, CRM, file-sharing, and payment-platform access for the affected accounts and time period. Look for unusual searches, exports, downloads, forwarding rules, permission changes, and connections to other systems. Identify the donor records and data fields that could have been accessed, and document gaps in available logs. Involve IT and counsel to assess applicable notification duties.

Which payment changes should be verified through an independent channel?

Verify new beneficiaries, changed bank or routing details, revised wire instructions, refund destinations, and requests to redirect donations, grants, or vendor payments. Call a known number already on file rather than relying on contact information supplied in the change request. Use a separate approver for wire transfers and record the verification.