{"success":true,"data":{"id":"ai-vishing-follow-up-bec-wire-transfer","label":"AI vishing follow-up BEC wire-transfer email — post-voice-call enforcement email \"as discussed on the call\" confirming a wire transfer or credential change, referencing a cloned-voice call as social proof. FBI IC3 2025-2026; Mandiant Apr 2026; FinCEN 2026.","description":"Post-voice-call enforcement email sent after an AI voice-cloning (vishing) attack, where the attacker cloned the voice of a CEO, CFO, or senior executive in a phone call to authorize a wire transfer or credential change. The follow-up email reinforces the call's instruction (\"as discussed on our call this morning\") to add legitimacy and requests wire transfer authorization, updated banking details, or account credential changes. Two-part detection: (1) explicit reference to a phone call / recent conversation (distinct from cold email), (2) wire transfer request or banking details change. BEC authority title (+1 bonus). FBI IC3 2025-2026 documented this two-stage vishing→email model as responsible for high-value BEC; Mandiant April 2026 Threat Intelligence Report confirmed active campaigns; FinCEN 2026 advisory. Score: +5 base, +1 if BEC authority title detected.","tier":"warning","category":"other","isThin":false}}