TL;DR: A fake wire confirmation is a payment advice, debit or credit advice, portal receipt, or forwarded customer copy that was edited after a bank produced it, or generated to describe a transfer that never settled. The FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints and $3,046,598,558 in reported losses. Visual review fails because a competent file keeps a real bank's layout and changes the amount, the beneficiary, or the reference.
A Confirmation Is a Claim About One Payment
A wire confirmation is a document offered as proof that one transfer happened. Sellers, title companies, and suppliers receive it as proof of payment before they release goods, a deed, or a refund. Lenders, escrow agents, and onboarding teams receive it as proof of funds, so one incoming credit stands in for liquidity. The page names an amount, a sender, a beneficiary, a value date, and a reference, and asks a reviewer to treat that page as settlement.
Settlement is the credit on the beneficiary account. The PDF is the story a party chose to attach. Changing the beneficiary on a live instruction is a different control, covered in wire fraud detection for banks. A fake bank statement answers how an account behaved across a period. A confirmation answers whether one transfer, in one amount, to one beneficiary, on one value date, actually moved.
The FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints and $3,046,598,558 in reported losses. The 2025 AFP Payments Fraud and Control Survey found that 79 percent of organizations faced attempted or actual payments fraud in 2024. Wire transfers were the payment method business email compromise targeted most frequently, cited by 63 percent of respondents, up from 39 percent in the previous survey. The document that follows those schemes is a tidy advice offered as proof the wire already settled.
What a Fake Wire Confirmation Actually Is
Two production paths cover the files that land in credit, treasury, and onboarding queues.
Edited-after-creation starts with a genuine advice or a portal export. The amount, the beneficiary name or account, or the reference is then changed so the page matches the deal. The logo and the wording stay. What moved is the file after the bank finished with it.
Generated-from-scratch never passed through a core system. The page is assembled in a design tool or a word processor, or produced by a model that imitates a bank portal, a payment advice, or a customer copy of an MT 103 or a pacs.008. The producer of the file is a person, or a model, working outside the bank that the header names.
A real outcome confirmation, on a cross-border payment, is a status the receiving institution sends back. Swift's universal confirmations rule requires institutions that receive an MT 103 or a pacs.008 to report whether the payment was credited to the beneficiary, rejected, placed on hold, or transferred to an agent outside Swift, within two business days of the interbank settlement date. An emailed PDF is a picture of a claim the sender chose to attach.
Tells That Still Work, and the Ones That Don't
Logo sharpness, a watermark, and a familiar layout fail as tests. A real advice becomes a template the moment a bank emails it to a customer, and a competent edit keeps that template. Visual review is slowest on the files whose layout already looks issued.
The tells that still earn their time connect the page to something outside the page. Amount, beneficiary, account, reference, and value date should describe the same payment the contract or the invoice already describes. A reference that fights the bill is the break a fake invoice review is built to catch: the payment story and the commercial story describe different deals. A beneficiary account new to the relationship is a consistency problem. The value date should be a day that bank would have processed, and the advice date should sit in the same window unless the file explains the gap.
A screenshot is an image of a screen, so the portal file's production method and timestamp trail never arrive with it. Ask for the download the banking session produced, then judge that file. When the only version on offer is a picture inside an email, the picture cannot carry the checks below. The settlement tell sits outside the document: the receiving account shows the credit, or the credit is absent.
How Detection Actually Works
Detection reads the file's story. Six checks, on the bytes and on the printed fields, separate an advice a bank produced from an advice someone assembled. The same classes of signal show up across document fraud in banking. On a wire confirmation they answer a narrower question: did this file come from the institution it names, and do its fields describe one payment.
Production method asks how the file was made. A portal export carries a producer a design tool does not. A print of a web page, a screenshot dropped into a document, and a page built from scratch leave different traces.
The timestamp trail lines up creation and last change with the value date and the advice date on the page. An edit after the bank produced the file often leaves a modification later than the payment the page describes.
Issuer matching asks whether the producer, the template, and the bank named on the page belong together. A consumer tool listed as the producer of a bank wire debit advice is a mismatch. So is one institution's layout that names a second bank in the header and a third in the footer.
Consistency checks the fields against each other and against the deal. Amount, currency, beneficiary, account, reference, value date, and charges should tell one story. Two fields that describe two different payments mean the file was edited or assembled from pieces.
Model artifacts are the residue of a page a language or image model produced: wording that tracks a bank and then drifts, a status badge that is a picture, a layout that is locally neat and globally off.
Recycled patterns catch the same advice skeleton on unrelated payments, the same reference with a new amount, or a template already seen on another applicant. A second copy of that structure should stop the file.
None of these checks replaces the credit at the receiving bank. They decide whether the document belongs in the file while that posting is still pending.
What to Do With a Suspect File
Hold the asset. Goods, a closing package, a refund, or a credit decision waits until the institution that holds the beneficiary account confirms the credit, through a number or a banker relationship that was already on file.
FinCEN's July 2019 advisory on email compromise tells institutions they may verify suspicious emailed payment instructions through multiple means of communication, including contact with others already authorized to conduct the transaction. The same discipline applies to a confirmation PDF. Phone numbers and portal links printed on the advice came from the party whose payment is in question.
Read the file on its own. Upload it and check a document in the Watchdoc playground, which takes the first file with no email and includes a 50-document free tier. A suspect result is a reason to reject, or to escalate with the x-ray attached. A clean result still waits on the credit. The document can be genuine while the payment is recalled, held, or credited to an account the deal never named.
When the credit is absent and a check fails, reject the file and keep the asset. Record the reference, the beneficiary details, and the sender address. A changed payment instruction belongs with the wire desk.
Where Sphinx Fits
Sphinx runs the six checks on the confirmation and will x-ray the file with the verdict. Published results on this work are a 94.3 percent correct verdict, 2.8 times more forgeries caught, and clean files cleared in under 28 seconds. The price is $0.45 per document, with no seats and no platform fee. The playground is free.
Frequently Asked Questions
Is a wire confirmation proof of payment?
A wire confirmation is a claim that a transfer was sent or received. Proof is the credit posted to the beneficiary account, confirmed with the receiving bank through a channel the sender did not provide. A PDF, a screenshot, or a forwarded customer copy can be edited or invented.
How is a fake wire confirmation different from a fake bank statement?
A wire confirmation covers one transfer: amount, parties, value date, and a reference. A bank statement covers activity across a period, with balances and a set of postings. Each file needs its own review, because each one is offered as proof of a different fact.
Can a screenshot of online banking count as a wire confirmation?
A screenshot is an image of a screen, so the original file's production method and timestamp trail are already gone. Treat the image as a generated picture until the receiving bank confirms the credit. If a portal download exists, review that file too, and still confirm the posting through a channel you already trust.
What should you do before releasing goods on a wire confirmation?
Hold the goods, the deed, or the refund until the receiving institution confirms the credit, using a phone number or a portal you already trust. Run the file through a document check so an edited amount, beneficiary, or reference is visible before the layout becomes the argument. If the credit is missing, reject the file and keep the asset.
Does a SWIFT copy mean the payment settled?
A customer copy of a credit-transfer message shows an instruction a bank may have sent. Settlement is a later status: credited, held, rejected, or transferred onward. Wait for the credit, or for a status your own bank can see on its own channel.
.png)
