Wire Fraud Kill Chain: 72 Hours After a Fraudulent Wire

A fraudulent wire transfer is not complete as soon as the money leaves your account.

For a few hours, the funds remain in the recipient’s account, and the bank can still freeze them.

FBI and the Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) have two programs designed for this short window: (i) Financial Fraud Kill Chain; and (ii) the Rapid Response Program.

Both require the victim to act quickly.

The 72-hour window, in the government’s words

According to FinCen’s Program Fact Sheet dated April 15, 2026 – “FinCEN is most likely to be able to interdict or recover funds when fraudulently induced wire transfers are reported to law enforcement within 72 hours of the transaction” (FinCEN, Rapid Response Program Fact Sheet, Apr. 15, 2026, p. 2).

The time frame set out in FinCEN’s email-compromise advisory is even more strict: “FinCEN has been more successful in recovering funds when victims or financial institutions report BEC-unauthorized and fraudulently induced wire transfers to law enforcement within 24 hours.” (FinCEN, FIN-2019-A005, July 16, 2019, p. 8).

The reason is often structural: [Wire] transactions are irrevocable, making financial institutions and customers unable to cancel payments or recall funds.” (FIN-2019-A005, p. 8).

FBI’s Internet Crime Complaint Center (IC3) agrees: “If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents” (FBI IC3, 2025 Internet Crime Report, Apr. 2026, p. 17).

What the Financial Fraud Kill Chain does

“Established in 2018, the IC3 RAT streamlines communications with financial institutions and FBI field offices to assist in the freezing of funds for victims of fraudulent domestic and international transactions” (IC3 Report, p. 17).

For domestic Kill Chain Process – “IC3 RAT will expand the FFKC process beyond the initial recipient bank if information is provided during the FFKC initiation on “second hop” transactions to other domestic or international accounts to request freezes on as much of the lost funds as possible.” (IC3 Report, p. 17).

In 2025 the kill chain was initiated on 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58 percent success rate; 3,574 of those incidents were domestic and 326 international (IC3 Report, p. 17).

What FinCEN’s Rapid Response Program does

When the funds left the country, FinCEN takes over.

According to FinCen’s Fact Sheet dated April 15, 2026 – “Since its inception in 2015, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network’s (FinCEN) Rapid Response Program (RRP) has facilitated the interdiction of $1.8 billion and the recovery of over $1 billion in stolen proceeds on behalf of 5,790 U.S. victims.” (RRP Fact Sheet, p. 1).

Two rules matter for victims.

First, “Please do not contact FinCEN directly”; the program activates only when law enforcement refers a complaint filed at IC3 or with the Secret Service (RRP Fact Sheet, p. 1).

Second, the complaint must contain details information about the victim. That information includes victim’s and beneficiary’s account names and numbers, both banks and their countries, the date, currency, amount, and a summary of the fraud (RRP Fact Sheet, p. 2). Incomplete information could delay investigation process.

How the wire gets out: five attack vectors

Business email compromise once dominated kill chain cases.

“However, in 2025, the [Kill Chain] process saw a rise in Tech Support and Account Takeover (ATO) initiations.”

Furthermore, “AT)-related incidents can contain upwards of 50 or more transactions to different recipient accounts at multiple banks happening simultaneously via ACH transactions” (IC3 Report, p. 17). [emphasis added].

The way fraud occurred matters because it could affect who is responsible for the loss.

1. Bank’s “fraud department.” “The scammer falsely informs the victim their computer and financial accounts have been accessed by a foreign hacker and the victim must move their money to a “safe” third-party account, such as an account with the Federal Reserve or another US Government agency.” (FBI PSA, “Phantom Hacker” Scams, Sept. 29, 2023). In this situation, the victim would be initiating/authorizing the wire transfer.
2. Phishing links. “Cyber criminals use advertisements that imitate legitimate companies to misdirect targets…. fraudulent URL appears at the top of search results…When targets click on the fraudulent advertisement link, they are redirected to a phishing website that closely mirrors the legitimate website…target enters login credentials, the cyber criminal intercepts the credentials.” (FBI PSA, Apr. 24, 2025).
3. Account takeover. “Once the impersonators have access and control of the accounts, the cyber criminals quickly wire funds to other criminal-controlled accounts, many of which are linked to cryptocurrency wallets; therefore, funds are disbursed quickly and are difficult to trace and recover. In some cases, including nearly all social engineering cases, the cyber criminals change the online account password, locking the owner out of their own financial account(s).” (FBI PSA, Nov. 25, 2025).
4. Malware/ Remote-access software. The FBI lists credentials obtained “via malware on the victim’s device” among ATO methods (FBI IC3, Account Takeover Fraud). In the tech-support variant, the scammer installs remote-desktop software and “can lock the victim out of their computer or place a black screen as they conduct unauthorized wire transfers” (FBI PSA, Nov. 10, 2022).
5. Business email compromise. Criminals “insert themselves into communications by impersonating a critical player in a business relationship or transaction” and alter the payment instructions (FIN-2019-A005, p. 6). BEC losses reported to IC3 in 2025: $3,046,598,558 (IC3 Report, p. 9).

The first 72 hours: what to do

1. Call the bank (Use number on your card or statement). Contact the originating institution “as soon as fraud is recognized to request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity” (FBI IC3, Domestic Financial Fraud Kill Chain Process). Get the wire reference number.
2. File at ic3.gov the same day. “It is vital the complaint contain all required data in provided fields, including banking information” (FBI PSA, Nov. 25, 2025). File “Regardless of the amount lost” (IC3 Report, p. 17).
3. Lock the intruder out. “Reset all credentials and passwords that may have been exposed,” from a device you trust (FBI PSA, Nov. 25, 2025).
4. Preserve everything. Save emails, texts, phone numbers, wire confirmations, and screenshots; the FBI asks for the caller’s name, contact methods, and the receiving account numbers (FBI PSA, Sept. 29, 2023).
5. Send nothing more. Scammers “may instruct the victim to send multiple transactions over a span of days or months” (FBI PSA, Sept. 29, 2023).
6. Get the bank’s timeline in writing. When was the recall sent, and what did the beneficiary bank answer? That record decides what can still be frozen and, later, who bears the loss.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.