The email arrived at 2:17 AM, which should have been Leon’s first warning.
activity, often followed by a unique Payment ID in the format XXXXXYYMMDDNNN Understanding WPS Transactions WPS Meaning: It identifies transactions processed through TD's Wire Payment Service
The email looked official. TD Bank logo. Clean formatting. No obvious typos.
…then a lookup feature would decode those.