Finance playbook · AI Employee: Fin

Wire Transfer Approval

Zero fraudulent or duplicate wires

Install this playbookBack to marketplace
The problem

Wire transfers are the single highest-risk finance action. One mis-directed wire is often unrecoverable — the money is gone before anyone notices. Business email compromise attacks specifically target wire flows: a fake CEO email, a spoofed vendor request, a plausible urgency. The manual approval flow ("CFO glances at the email") is the exact failure mode BEC exploits.

At a glance
Trigger
Form
Approvals
Two-person + treasury approval
What it does
Writes to your systems
Systems
NetSuite · Bill · Bank
How it feels in production

An hour-by-hour walkthrough.

3:14pm. AP needs to wire $47,000 to Acme Vendor for their Q4 services invoice. Priya (AP clerk) DMs Fin: "$47k wire to Acme Vendor, invoice #12345, approved by procurement." 3:14pm + 5 sec. Fin verifies: Acme Vendor is on the approved-beneficiary list (bank account, tax ID, wire instructions all match the pre-vetted record). Invoice #12345 exists in NetSuite (matched via 3-way match with the PO and receipt). Procurement approval on file. All good. 3:14pm + 10 sec. Fin routes the wire for approval: Treasury (primary) + CFO (secondary) both required, step-up MFA on both. Wire card includes: amount, beneficiary, invoice reference, approval history, risk score (low — matches vetted record). 3:20pm. Treasury taps Approve after fresh MFA. 3:23pm CFO taps Approve after fresh MFA. Fin submits the wire to the bank via API. Confirmation returned; audit event written. If the beneficiary weren't on the vetted list, or if invoice matching failed, or if the amount exceeded normal patterns — Fin escalates. Never processes a wire that isn't fully verified. For a hypothetical BEC attempt ("urgent wire from CEO to new account"): Fin detects new-beneficiary + urgency-language + no matching invoice, refuses to route, alerts security. The attack fails at the automation layer instead of at the CFO's inbox.
How it works

Step by step.

  1. 01

    Collect wire request + docs

    Requester provides: amount, beneficiary, invoice / PO reference, business justification. Fin ingests via Slack / Teams / portal, extracts structured data.

    Slack · Teams · Portal · NetSuite
  2. 02

    Verify beneficiary against approved list

    Cross-check against the vetted-beneficiary list: bank account, routing number, tax ID, address. Mismatch or missing = escalation. Never wire to a beneficiary not on the list without explicit approval.

    Bank · NetSuite · Bill.com
  3. 03

    3-way invoice match

    Verify invoice, PO, and receipt all match (amount, quantity, terms). Discrepancy = flag for AP review, not auto-approve.

    NetSuite · Bill.com · Coupa
  4. 04

    Route for approval

    Two-person approval required: treasury + CFO (or DoA-defined equivalent). Both require step-up MFA on the approval action. Approval card includes full context + risk score.

    Slack · Approval Policies
  5. 05

    Execute after multi-party sign-off

    Once both approvers confirm with MFA, Fin submits the wire via bank API. Bank confirmation returned. Audit event written with all approvers, timestamps, and MFA verification.

    Bank API · Audit log
Systems and wiring

What you connect to make this run.

Bank (JPMorgan · SVB · Wise · Mercury)

write

Bank API with wire-transfer scope. Wire submitted only after all approvals + MFA verifications complete. Idempotent by request-hash to prevent duplicate submission.

NetSuite · Bill.com · Coupa

read

Read invoice + PO + receipt for 3-way match. Beneficiary record read for verification. Every wire tied back to a specific invoice.

Slack · Teams

write

Approval routing. Step-up MFA challenges via Okta / Duo. Approval cards include full context — no approver has to switch context to decide.

Vanta · Drata

write

SOC 2 evidence auto-generated per wire: approval chain, MFA verifications, timestamps. Continuous audit-readiness.

What changes

Before and after, honestly.

Time from request to executed wire
Before
1-2 business days across email chains + manual verification
After
Under 30 minutes with clean requests, hours for exception cases
BEC attack success rate
Before
Industry-average 3-5% of attempts succeed
After
Zero — verification catches every mismatched request
Duplicate / erroneous wires
Before
1-2 per year (huge financial impact)
After
Zero via idempotency + 3-way match
Audit preparation time
Before
Days reconstructing approval chains from email
After
Zero (audit log has everything)
Related

Playbooks that pair with this one.

Finance

Bill Payment Approval

The general-case AP flow; wires are the highest-risk variant.

Finance

Vendor Intake & Onboarding

New beneficiaries require the vendor-onboarding vetting before their first wire.

Finance

Vendor Risk + Payment Hold

Vendors that change risk posture get payments frozen before wires attempt.

Security

Security Alert Triage & Context

BEC-attempt detections feed the security queue for investigation.

Frequently asked

Answers about this playbook.

What if we need to wire to a brand-new beneficiary urgently?

Exception path with additional scrutiny. Requester provides bank details; treasury independently verifies via a phone call to a known contact at the vendor (never via reply-email — that's exactly the BEC vector). Verified new beneficiary gets added to the approved list. Same two-person approval.

How does this handle international wires?

Same flow with international-wire-specific fields (SWIFT, IBAN, correspondent banks, purpose code). Some jurisdictions require additional documentation; Fin collects at intake.

What's the CFO-level approval threshold?

Configurable per your DoA. Common thresholds: treasury for wires up to $50k, treasury + CFO for $50k-$500k, treasury + CFO + board for above $500k. Fin routes per your matrix.

Can we auto-approve recurring wires (e.g., monthly rent)?

Yes — recurring-wire template with periodic-approval refresh. Board approves the recurring wire once ("$25k monthly to landlord for 12 months"); individual instances execute without per-wire approval, still with audit + notification.

What if a wire fails at the bank?

Bank API returns the failure reason (insufficient funds, invalid beneficiary, sanctions match). Fin surfaces to treasury with the specific error; nothing retried automatically for banking failures.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Finance playbooks