Wire Fraud: What Victims Must Do in the First 72 Hours

A closing wire goes to the wrong account. A medical practice pays a fake invoice. A law firm releases escrow on fraudulent instructions. In each case, the same recall window applies, and liability often turns on one question: which system was compromised. Dilendorf Law Firm represents wire fraud victims across real estate, healthcare, legal services, and business.

Who is being targeted

Business email compromise drives modern wire fraud.

The FBI defines it as a scam “targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments,” carried out “by compromising email accounts and other forms of communication” [1].

In 2025 the Internet Crime Complaint Center received 24,768 BEC complaints with losses of $3,046,598,558, and 12,368 real estate complaints with losses of $275,110,419 [1].

The patterns repeat across industries. In real estate, the FBI’s 2025 examples include a $1.3 million closing diverted by a compromised “title company” email and a $449,000 wire sent after purchasers “received an email impersonating their legitimate attorneys” [1].

In healthcare, HHS describes the attacker who “spoofs a person or organization the target knows, like a supplier, and asks for a fake invoice to be paid” [2]. Law firms are targeted because they hold escrow and release funds on instruction.

How wires and ACH actually move

The payment system explains the urgency.

The Fedwire Funds Service is “a real-time gross settlement system that enables participants to initiate funds transfer that are immediate, final, and irrevocable once processed” [3].

The transfer is completed within seconds and cannot be reversed. What a victim calls a “recall” is a request that the receiving bank freeze and return funds still sitting in the beneficiary’s account.

New York law reflects that. Once a payment order has been accepted, “cancellation or amendment of the order is not effective unless the receiving bank agrees,” with narrow exceptions including an order “issued in execution of an unauthorized payment order” [4].

The statute gives the victim a basis to demand action; it does not return funds already withdrawn.

ACH works differently. The automated clearinghouse “is a nationwide network through which depository institutions send each other batches of electronic credit and debit transfers,” and the operators “receive files of ACH payments from originating depository financial institutions, edit and sort the payments, deliver the payments to receiving depository financial institutions, and settle the payments” [5].

Batching creates a short interval in which a file may be stopped before settlement; once an ACH credit posts, the same race begins.

Why 24 to 72 hours matter most

Criminal accounts are emptied quickly, often through second-hop transfers to other accounts.

FinCEN’s 2019 advisory reported “greater success in recovering funds when victims or financial institutions report BEC-unauthorized and fraudulently induced wire transfers to law enforcement within 24 hours” [6]; its 2022 fact sheet puts the window at “within 72 hours of the transaction” [7], and the FBI’s Chicago BEC task force states it must be able to act within 72 hours of the money leaving the account [8].

In fiscal year 2025, $362.6 million was reported to the program and $182.2 million, 50 percent, was frozen [9].

Domestic wires run through the FBI’s Recovery Asset Team and the Financial Fraud Kill Chain, which in 2025 froze $679,013,183 of $1,163,919,846 in attempted theft, a 58 percent success rate [1].

International wires are routed through FinCEN’s Rapid Response Team and FBI legal attaché offices [10].

Both are activated by an IC3 complaint with complete transaction details, filed alongside the victim’s recall and indemnification request to its bank [1].

Who was compromised: forensics before blame

Victims rarely know how the fraud happened.

The instructions may have come from the victim’s own compromised mailbox, from the vendor’s or counterparty’s, or from a look-alike domain that touched neither.

The answer is in the records: mailbox audit logs, forwarding rules, sign-in events, IP history, device images and the headers of the fraudulent email.

Providers hold these records under retention periods that are short or unknown, which is why preservation letters go out on day one.

The firm brings in its forensic team at the outset to perform a root cause analysis of the victim’s environment and, where cooperation or legal process permits, the counterparty’s.

That analysis supports the bank’s indemnification documents, the IC3 and Secret Service filings, notice to a cyber insurance carrier where a policy exists, and the eventual liability case, with the same investigators available as expert witnesses.

Allocating the loss

If the funds cannot be recovered, the dispute becomes one of liability among the victim, the counterparty whose email was compromised, the bank and sometimes a title or escrow agent.

Between a customer and its bank, New York UCC Article 4-A asks whether the bank verified the order under a “commercially reasonable method of providing security against unauthorized payment orders” and acted “in good faith and in compliance with the bank’s obligations under the security procedure” [11].

Where the instructions named the legitimate payee but gave the criminal’s account number, a beneficiary’s bank that does not know of the mismatch “may rely on the number as the proper identification of the beneficiary” [12].

Between the transaction parties, the question is who failed to protect their systems and who failed to verify.

Finding the people behind the wire

Clients often ask the firm to identify who was behind the transaction. It is difficult, and it is not impossible.

The beneficiary account was opened by someone, usually a money mule or a shell entity, and the bank holds the opening records.

The attacker’s logins carry IP addresses and timestamps; VPN and hosting providers hold subscriber records behind them.

Reaching that evidence requires law enforcement, subpoenas against the account holder and the providers, and forensic analysts who can follow infrastructure across services.

Complaint data also links accounts across victims; in 2025 the Recovery Asset Team recognized a repeat recipient account from an earlier case, and the originating bank issued a recall of a $6 million wire [1].

This article is for general informational purposes only and does not constitute legal advice. Every matter depends on its own facts and no outcome is guaranteed. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Prior results do not guarantee a similar outcome. Attorney Advertising.