We represent businesses, family offices, and individuals whose funds were stolen through fraudulent wire transfers.
An attacker compromises an email account, watches for weeks, then forges a wire instruction at the perfect moment. Within hours, the funds are gone.
What’s left is a legal question — which institution in the chain failed, and what claims will recover the loss.
Contact us at info@dilendorf.com or 212.457.9797 for a confidential consultation.
An attacker compromises a legitimate business email account — through phishing, credential theft, malware, or a SIM-swap that defeats text-message two-factor authentication. The attacker then spends days or weeks inside the account, studying communication patterns, vendor relationships, payment cycles, and the writing styles of executives and counterparties.
When a legitimate wire transfer is imminent — a real estate closing, a vendor payment, an escrow release, a payroll run — the attacker intervenes, forging an instruction from an executive, a vendor, a title company, or a lawyer.
The wire is diverted to a criminal-controlled account, and within hours the funds are gone.
Experience What is left is a legal question: which institution in the chain failed, and what claims will recover the loss? That is the work we do.
The anatomy of the loss
An attacker compromises a legitimate business email account — through phishing, credential theft, malware, or a SIM-swap that defeats text-message two-factor authentication.
The attacker then spends days or weeks inside the account, studying communication patterns, vendor relationships, payment cycles, and the writing styles of executives and counterparties.
When a legitimate wire transfer is imminent — a real estate closing, a vendor payment, an escrow release, a payroll run — the attacker intervenes, forging an instruction from an executive, a vendor, a title company, or a lawyer. The wire is diverted to a criminal-controlled account, and within hours the funds are gone.
What is left is a legal question: which institution in the chain failed, and what claims will recover the loss? That is the work we do.
Common attack patterns
The fraudulent instructions look authentic because they come from — or appear to come from — a real business email account, often using a near-identical lookalike domain.
Most cases fit one of these patterns — but not all. Tell us what happened and we’ll assess the recovery path.
The person who initiated the transfer is usually unreachable. But the U.S. banks, processors, and providers in the chain are — and their failures are typically what made the loss possible. Each is a potential defendant.
Once a fraudulent wire arrives at the destination bank, funds are typically transferred out, withdrawn, or converted to cryptocurrency within hours.
Recovery from the receiving bank often depends on whether that bank applied Bank Secrecy Act and anti-money-laundering procedures to flag the suspicious incoming transfer—particularly when a small or newly opened account receives a large incoming wire that is immediately drained.
We pursue claims against receiving banks that ignored obvious red flags: shell account names not matching the wire reference, rapid pass-through of large incoming wires, multiple fraud-related incoming wires to the same account, and failures to comply with FinCEN Suspicious Activity Reporting (SAR) obligations.
Sending banks can also bear liability under UCC Article 4A where they failed to implement or follow commercially reasonable security procedures.
Common issues include:
UCC Article 4A allocates loss between the customer and the bank based on the parties’ adherence to a “commercially reasonable” security procedure—and many banks fall short.
Where the underlying email account compromise resulted from a security failure by the email or IT service provider—inadequate authentication controls, failure to detect ongoing intrusion, failure to alert the customer to anomalous access—the provider may also bear liability.
This is particularly relevant for managed service providers (MSPs) and IT vendors who contracted to provide specific security services and failed to deliver them.
Recovery of fraudulent wire transfers depends almost entirely on speed.
Within the first 24-72 hours, victims should:
If your business, family office, escrow account, or personal account has been hit by a fraudulent wire transfer, BEC attack, vendor impersonation, or spear-phishing scheme, contact us at info@dilendorf.com or 212.457.9797 for a confidential consultation.
The first 24-72 hours determine whether recovery is possible.
