$20.9B
in losses from cyber-enabled crime reported to the FBI in 2025, up 26% from the year before.
McDonald Hopkins on the FBI IC3 2025 report, April 2026Every payment, trade, and approval starts as an instruction someone sends. DOR proves each one is authentic and unchanged before money moves, so what your team approved is exactly what goes out.
This is already happening.
The costliest attacks on finance in 2025 and 2026 did not break into the vault. They changed the instruction, or the face on the call.
$3.05B
lost to business email compromise in 2025 across 24,768 complaints: payment instructions and invoices that looked legitimate and were not.
McDonald Hopkins on the FBI IC3 2025 report, April 2026$1.5B
taken from a crypto exchange in February 2025 after attackers altered the signing screen. Signers saw the correct address while the transaction underneath sent the funds elsewhere.
Bitdefender, February 2025€12B
estimated lost to scams by households in Germany in a single year, most of it in transfers victims were manipulated into authorizing themselves.
Worldline and the Global Anti-Scam Alliance, October 2026Oct 21, 2026
the day India's largest bank disclosed that customer records, including names, phone numbers, and loan details, had turned up on the dark web.
Insurance Journal, October 202630 days
the most time covered SEC-registered firms now have to notify customers whose sensitive information was accessed. The smallest firms had to comply by June 3, 2026.
Davis Wright Tremaine, May 2026Every instruction proven before money moves.
Payments, markets, custody, and the people who approve them all act on what they are told. DOR proves it first.
Payments and Money MovementWires, ACH, instant payments, and the messages between institutions.Markets and TradingPrices, orders, clocks, and the models that act on them in milliseconds.Custody and Digital AssetsWho owns what, and what a signer actually approves.People and AccountsThe executive on the call, the caller at the bank, the customer at the door.Records and ReportingThe books, the audit trail, and the rules you answer to.
Payments and Money Movement
Wires, ACH, instant payments, and the messages between institutions.
M-01
Wires and payment instructions
A changed account number on an invoice or wire instruction looks identical to the legitimate one until the money is gone. DOR proves every payment instruction came from who it claims and that no detail changed between approval and release.
M-02
Instant payments
Instant payments settle in seconds and cannot be called back. DOR verifies the instruction at the speed of the payment, before it leaves, and holds one it cannot prove.
M-03
Messages between institutions
Payment and settlement messages pass through many systems on the way from one institution to another. DOR checks each message where it arrives against where it started, and rejects a replay of one already processed.
Markets and Trading
Prices, orders, clocks, and the models that act on them in milliseconds.
T-01
Market data
Trading systems act on prices and news within milliseconds. DOR proves each feed came from its source, unaltered and current, so a model never trades on data someone injected or held back.
T-02
Orders and the clock
Regulators reconstruct trading from order timestamps, and those timestamps are only as sound as the clock behind them. DOR checks time where it enters and keeps the true order of events even if a clock is changed.
T-03
Models and AI
Trading, credit, and fraud models can be quietly swapped or fed altered data. DOR confirms the model in use is the approved one and records what went into each decision.
Custody and Digital Assets
Who owns what, and what a signer actually approves.
K-01
What the signer sees
In 2025, signers approved a transfer their screen showed as correct while the transaction underneath sent $1.5 billion elsewhere. DOR checks the signing software and the transaction itself against what was approved, and holds the transfer when they differ.
K-02
Custody records
Custody and wallet records decide who owns what. DOR keeps every record provable from the moment it is written.
People and Accounts
The executive on the call, the caller at the bank, the customer at the door.
P-01
Executives on a call
A cloned face or voice of a CFO can join a video call and approve a transfer. DOR confirms who is on the call while it is happening and flags one it cannot verify.
P-02
The call center
Callers with cloned voices and stolen details talk their way past account security. DOR confirms the caller before anything on the account changes.
P-03
Opening accounts
Faked IDs and generated faces open accounts that exist only to move money. DOR checks where every document and image came from before it is accepted.
P-04
Insiders
Someone with legitimate access can move money or data for the wrong reason. DOR requires a name and a reason for sensitive actions and keeps a record of them that no one can edit.
Records and Reporting
The books, the audit trail, and the rules you answer to.
R-01
Ledgers and reports
Ledgers, statements, and regulatory reports can be altered, backdated, or changed after they are shared. DOR locks in what was recorded and when, and its proof travels with the data.
R-02
After an incident
Attackers erase and edit logs to hide what they did. DOR keeps a record of what your systems received and acted on that cannot be edited, so investigation starts from what actually happened.
R-03
The rules you answer to
SEC Regulation S-P, the New York cybersecurity regulation, the GLBA Safeguards Rule, and the EU's Digital Operational Resilience Act all ask institutions to show what their systems did. DOR produces that record.
How DOR works with you.
Nothing to rip out. No dependence on a link to the outside. Every deployment starts with your systems as they are.
Walk the system
DOR maps what your payment, trading, and account systems receive and act on, from the first instruction to the final record.
Build to it
Every deployment is built to your platforms, your approval chains, and the rules you answer to.
Deploy on what you run
DOR runs as software on the systems you already operate, fully offline. Where a site has nothing suitable, DOR provides a compact host built for it.
Hand over the evidence
You get a record of what was checked, what was held, and why. It cannot be edited.
Inside every deployment
- Verification where it arrives
- Instructions, messages, prices, and calls are proven authentic before your systems or your people act on them.
- A hold, not just an alarm
- Anything that fails is held. It moves only when an authorized person releases it with a recorded reason.
- A record that stands
- What was checked, held, and released, kept in a record no one can edit.
Questions institutions ask.
Straight answers to what bank, payments, markets, and treasury leaders ask first.
Does DOR move money or make financial decisions?
No. DOR checks whether instructions, messages, and data are authentic and unchanged. Payment, trading, and credit decisions stay with your people and your systems.
Will DOR slow down payments or trading?
DOR verifies at the pace of the system it protects, including instant payments. Every deployment is built and tested against your platforms before it goes live.
Do we have to replace our core, payment, or trading platforms?
Usually not. DOR runs as software on the systems you already operate, and provides a compact host when a site has nothing suitable.
Does DOR replace our fraud tools?
No. Fraud tools score behavior and look for patterns. DOR proves the instruction itself is authentic, which gives those tools firmer ground to work from.
Does DOR need a cloud connection?
No. DOR runs fully offline and depends on no outside service to verify anything.
What happens to customer data?
It stays where it already lives. DOR does not need customer data to leave your environment to verify anything.
How does DOR help with SEC, New York, GLBA, and EU requirements?
Each asks institutions to show what their systems did and when. DOR produces a verifiable record of what your systems received, checked, and acted on that cannot be edited, which supports examinations, audits, and incident notices. Amended Regulation S-P requires covered firms to notify affected customers within 30 days and to hear from service providers within 72 hours of a breach; larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026.
Is DOR only for large institutions?
No. Every deployment is built to the system in front of it, from a community bank or credit union to a global institution.
What does an engagement with DOR look like?
DOR walks your systems, builds to your platforms and rules, deploys on what you already run, and hands you the evidence. It starts with a briefing.
Reference
The Finance Reference.
The full list behind this page: how payment, market, custody, and account systems get fooled, in plain language, with what DOR does about each one.
Finance
Start with a briefing.
Bring your payment flows and approval chains, or just the question your treasury team keeps asking. DOR will show you exactly where it fits.