Would love some opinions on wire call backs. Do y'all call the customer on every wire request? Or are you doing a risk assessment based on things like size of the wire, how it was requested, whether or not it's expected behavior and so on?

We do callbacks for any wires that are not done in person.

Whatever you are doing, it has to pass the "reasonable security" aspects of the UCC-4A. Without out it, the bank is going to be on the hook for any claims of an erroneous transfer. This is a discussion to have with your legal counsel.

§ 4A-201. SECURITY PROCEDURE.

"Security procedure" means a procedure established by agreement of a customer and a receiving bank for the purpose of (i) verifying that a payment order or communication amending or cancelling a payment order is that of the customer, or (ii) detecting error in the transmission or the content of the payment order or communication. A security procedure may require the use of algorithms or other codes, identifying words or numbers, encryption, callback procedures, or similar security devices. Comparison of a signature on a payment order or communication with an authorized specimen signature of the customer is not by itself a security procedure.

We do call backs on all non in person requests. For businesses with more than one person authorized, we require the call back not be to the requestor. So Jack inputs and Sally receives the call back to confirm the details.

Are you doing wire call backs in addition to MFA?

We call back every customer, every wire, every time. Unless you want to be on the hook for fraud.

One step further, we also verify the phone number on our system hasn't been changed in the last 90 days.

Good afternoon,

You should also check your insurance requirements. That may be more stringent than UCC.