Wire is Gone: Recovering Losses After Bank Says No

Common wire fraud fact pattern: U.S. company receives an email from a vendor that appears to be ordinary, requesting that it update its bank details before the next payment.

The controller then wires $500,000. Two days later, the vendor calls to ask where the money is.

The company contacts its bank. Bank issues a request to recall the funds.

Within a few hours, it receives a reply that the receiving bank has credited the money and that the account holder has already transferred it out in amounts ranging from $60,000 to $80,000.

There is now nothing left to return.

Business email compromise (“BEC”) is a type of fraud. The FBI’s Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints and reported losses of $3.05 billion in 2025. This makes it the second-most costly type of cybercrime ([1]).

By the 48-hour mark, when the first account has been emptied, the chances have decreased (although they have not disappeared completely).

Once the bank says that it can’t reverse the transfer, victim company should consider the following protective steps described in this post.

Why the bank can’t simply take the money back

According to Article 4A of the Uniform Commercial Code, once a payment order has been accepted, cancellation is not valid unless the receiving bank agrees to it. There is, however, a narrow exception in the case of unauthorized or mistaken orders ([11]).

Even if deceived, the company agreed to the wire. When the account number and the name do not match, the beneficiary’s bank as a general rule “may rely on the number as the proper identification of the beneficiary” ([12]). And that’s the big problem for the victim company.

A recall is a request (not a default right), and it applies only as long as the money remains in the first account.

However, by the time the victim realizes the fraud, the money is often long gone from that account.

The FBI continues to tell victims to make this request right away, together with “any necessary indemnification documents” ([1]). A request must be made; it is not the final step.

The money is not gone; it has moved

Criminals send the money stolen from victims via “money mules.” These mules get the money from the victims and send the funds to conspirators, many of whom are based overseas ([7]).

According to FBI data, the funds involved in BEC are being sent to over 140 different receiving countries, via intermediary banks in the United Kingdom, Hong Kong, China, Mexico, and the United Arab Emirates.

More and more are going into custodial accounts held by payment processors, peer-to-peer platforms, and crypto exchanges ([2]).

Batches ranging from $60,000 to $80,000 are intended to bypass banks’ AML filters.

Each of those transfers ends up in a different account at another bank, where it can be identified and, depending on the circumstances, frozen.

Step one: complete IC3 complaint

The FBI’s Recovery Asset Team (RAT) operates the Financial Fraud Kill Chain (“FFKC”). The FFKC works with banks, asking them to freeze fraudulent transfers. Dilendorf Law Firm works with retired FBI IC3 agents to facilitate processing of complaints with the IC3 unit.

In 2025, the RAT froze $679 million out of the $1.16 billion that criminals had attempted to steal, achieving a success rate of 58 percent ([1]).

For a company at hour 48, the FBI states that it “will expand the FFKC process beyond the initial recipient bank if information is provided during the FFKC initiation on ‘second hop’ transactions to other domestic or international accounts” ([1]).

FinCEN’s Rapid Response Program handles cases involving wires sent to foreign accounts and has assisted in the recovery of over $1 billion since 2015.

FinCEN says that it is most likely to interdict funds reported to law enforcement within 72 hours; however, it does not claim that recovery is impossible after that time ([3]).

Victims do not contact FinCEN themselves. Instead, they file a complaint with IC3 or the nearest Secret Service field office, providing all account and bank details for both parties along with a summary of the fraud ([3]).

A bare complaint only goes as far as the first account. One that includes all that the bank knows about the onward transfers allows the FBI to pursue the second hop.

Step two: push the banks to use their own tools

FinCEN’s advisory on BEC informs financial institutions that they have a duty to file a suspicious activity report “regardless of whether the scheme or involved transactions were successful.”

Furthermore, the fact that a recovery request has been made does not release them from that obligation ([4]).

Section 314(b) of the USA PATRIOT Act enables banks to share information with one another, benefiting from a liability safe harbor, regarding transactions which may involve fraud proceeds, such as those connected with wire fraud and “money mule” schemes ([5]).

You should ask the company’s bank in writing to activate both of these channels with the receiving bank and with each subsequent bank as it is identified.

Step three: the forfeiture route

Even after the first account has been emptied, the Department of Justice can trace and seize the stolen money and return it.

In a case in Massachusetts, a workers’ union sent $6.4 million via an email that had been spoofed by only one letter.

The government’s complaint states that the money passed “through a series of intermediary bank accounts,” some of it being routed to a cryptocurrency exchange and to banks in Hong Kong, China, Singapore, and Nigeria.

The investigators were still able to trace the funds to seven domestic accounts, seized them, and brought a civil forfeiture action worth about $5.3 million ([8]).

In a case in Florida, $2,462,000 that had been stolen through an email impersonating a vendor was seized, forfeited, and sent “back to the victim” ([9]).

The process involves remission and restoration as set out in 28 C.F.R. Part 9. A person qualifies as a victim if they have suffered a specific pecuniary loss as a direct result of the crime, and the petition must contain “documentary evidence of a specific pecuniary (i.e., monetary) loss and the date the loss occurred” ([6]).

A petitioner could be disqualified if they have recourse to other reasonably available assets or compensation, so the insurance and counterparty issues discussed below should be dealt with carefully ([6]).

Step four: identify every other pocket

Depending on the facts, a victim may have claims or leverage beyond the thief’s accounts:

• The other party involved. FinCEN recommends that banks record which “compromised or impersonated parties” were involved, note whether auto-forwarding or inbox rules had been set, and indicate whether the authentication compromised was single-factor or multi-factor ([4]). When the vendor’s mailbox has been breached, the question of how to allocate the loss between the two companies is still an open one and will be decided by forensic evidence.
• The holders of the receiving accounts. The attachment statute in New York allows a court, on an appropriate showing, to attach the property of a defendant who is a nondomiciliary or foreign corporation, or one who “has assigned, disposed of, encumbered or secreted property” with the intent to defraud creditors ([14]). Civil proceedings directed at the identified holders of mule accounts can reach funds that have not been seized criminally.
• The company’s own bank. Under Article 4A, the risk of an unauthorized payment order is allocated in accordance with the bank’s security procedure ([13]). Where the customer has authorized the wire, the claim is less extensive, but it still needs to be examined.
• Insurers. Make sure that every policy which could possibly respond to the loss is notified promptly.
• Taxes. The IRS regards money taken “through fraud or misrepresentation” as stolen, and the loss can be deducted in the year the theft is discovered, but not so long as there is “a claim for reimbursement with a reasonable prospect of recovery” ([15]).

Preserve the evidence

The Secret Service states that “any delays will decrease the likelihood of financial recovery” and advises victims to “maintain records of all potential evidence” ([10]).

Victims should not wipe the devices in question. They must export the full email headers and obtain the mailbox audit logs before the retention periods expire.

Contact US

At Dilendorf Law Firm, we represent U.S. and non-U.S. companies whose wires have been diverted through business email compromise, from the first IC3 complaint through tracing, bank negotiations, and forfeiture petitions.

Where appropriate, we may pursue claims against counterparties, account holders, and financial institutions.

You can reach us at +1 212 457 9797 or by email at info@dilendorf.com.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.