Wire Fraud & Business Email Compromise Lawyers
The wire went to the wrong account. The instructions looked right. Now the bank, the counterparty and the insurer are each pointing somewhere else.
We run the recall and freeze process, establish whose mailbox was compromised, and pursue the party whose failure let the fraud through.
The question that decides everything: whose system was compromised?
In a business email compromise, someone’s mailbox was breached. It was the buyer’s, the seller’s, the lawyer’s, the title agent’s or the vendor’s.
The party whose system was compromised usually bears the loss. The party who failed to verify changed instructions may share it.
That is a forensic question. We answer it with tenant logs and device review before the other side answers it for you.
Business email compromise is the most expensive fraud in America.
FBI figures for 2025, and the recovery mechanism that depends on speed.
Under New York’s commercial code, a bank can hold a business to a wire “whether or not authorized” if it followed a commercially reasonable security procedure in good faith. The claim then turns on the counterparty or the compromised party. Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; 12 CFR 1005.2(b); N.Y. UCC § 4-A-202.
Recall. Attribute. Recover.
Recall and freeze requests
Immediate contact with sending and receiving banks. Hold-harmless and indemnity letters prepared the same way every time.
FBI Recovery Asset Team reporting
IC3 complaints filed with the detail the Kill Chain process requires: amounts, accounts, dates and the fraud narrative.
Mailbox and tenant attribution
Forensic review of every party’s email environment to establish where the compromise occurred.
Claims against counterparties
Demands and litigation against the party whose system was compromised or who failed to verify changed instructions.
Claims against banks
Where the bank’s security procedure was unreasonable or it ignored red flags, claims under UCC Article 4-A and related duties.
Insurance and restitution
Crime and funds-transfer-fraud claims, and restitution through any criminal case that follows.
The first 72 hours after a fraudulent wire.
Recall, reporting and attribution start at the same time.
Recall request
Sending bank contacted immediately. Receiving bank asked to hold. Times and names logged.
IC3 report
Filed with complete transaction detail so the FBI’s Recovery Asset Team can act.
Preservation
Every party is asked to preserve its email tenant, devices and logs.
Attribution
Forensic review establishes whose mailbox was compromised and when.
Demand and claim
Demand to the responsible party. Litigation or arbitration if it is refused.
Investigators and lawyers, under one roof.
Retired federal law enforcement.
Former federal investigators and analysts who spent their careers on cyber and financial crime. They handle the forensics, the tracing and the contact with current law enforcement.
Arbitrating cybercrime disputes since 2019.
Counsel in more than 130 arbitrations before AAA, JAMS and NAM, most arising from cybercrime and account takeovers. We try these cases on the evidence.
A wire just went to a fraudster.
Funds often move again within hours. The recall request cannot wait for a meeting.
- Call your bank now and request a recall; ask for the receiving bank’s fraud desk
- File at ic3.gov with exact amounts, account numbers and dates
- Preserve the fraudulent emails with full headers
- Tell every party to the transaction to preserve their email and devices
- Call counsel the same day
- Assume the counterparty’s explanation of the breach
- Delete or forward the fraudulent emails without preserving originals
- Let your IT staff “clean up” mailboxes before imaging
- Give a recorded statement to an insurer before attribution
- Wait to see whether the bank recovers it on its own
From the firm’s writing.
Wire Fraud: What Victims Must Do in the First 72 Hours
The recall, reporting and preservation sequence.
Read the articleReal Estate Wire Fraud: Whose System Was Compromised?
Why attribution decides who bears a lost closing wire.
Read the articleBusiness Account Takeover: Is Your Bank Liable?
The limits of a bank’s duty on business accounts.
Read the articleFrequently asked.
Sometimes. In 2025 the FBI’s Recovery Asset Team froze 58 percent of the fraudulent transfers reported to it.
Success depends on reporting within hours with complete detail. After that, recovery shifts to claims against responsible parties.
For business accounts, usually not if it followed a commercially reasonable security procedure. New York’s UCC Article 4-A sets that standard.
Liability shifts if the bank ignored its own procedure or clear red flags.
Often the party whose email was compromised, or the party who failed to verify new instructions by phone.
That is why forensic attribution comes before any demand.
No. The question is who compromised the instructions and who failed to verify. The employee’s act is the mechanism, not the cause.
Crime and funds-transfer-fraud coverages may. The characterization of the event matters, and notice conditions are strict.
Yes. The report creates the official record, supports restitution if there is a prosecution, and helps the FBI connect your case to others.
Other areas of the practice.
Every page of the cybercrime practice, from the first hour of an incident to the final award. Back to the overview.
A wire went to the wrong account. Start the recall now.
Confidential consultation. We will tell you what can still be frozen, whose system to examine and who should bear the loss.