Any one of these flags would warrant a pause. The combination is consistent with a vendor email compromise attempting to redirect payment. The threat actor likely intercepted the bank-change request, slipped past the callback control, and timed the diversion to the next large invoice.

I have not released the wire. Devon's request and Aaron's approval are both valid — neither would have known about the missing callback without me surfacing it. That's exactly the gap Wire Sentinel exists to close.

Recommendation: Let me assemble the full evidence chain across Fusion, PNC, ServiceNow, email, and the vendor onboarding folder so you can decide in 30 seconds.