You've just discovered that the wire you approved went to a fraudster. The vendor's email looked familiar, the invoice matched the project, and the account details seemed routine. Now your chest is tight, your phone won't stop buzzing, and you're replaying every message to find the moment the deception began.

Stop investigating for the moment. Wire transfer fraud recovery is an emergency measured in hours, not weeks. The FBI's Recovery Asset Team placed holds on $538.39 million of $758.05 million in fraudulent wire transfers in 2023, a 71% freeze rate, according to this wire fraud recovery benchmark. That result doesn't promise your money will come back, but it shows why an immediate, coordinated response matters.

Your case will usually fall into one of two lanes: a domestic bank recall or an international recovery effort involving the FBI's Financial Fraud Kill Chain. The right lane depends on where the money went, how quickly you report it, and whether the funds remain in the beneficiary account.

The First 72 Hours After a Fraudulent Wire

On Monday morning, a controller at a mid-sized construction firm reviews a payment sent the previous week. The company wired $412,000 to what appeared to be a vetted vendor. Then the controller notices that the email thread had been spoofed for three weeks. The vendor never changed its account. The fraudster did.

That discovery creates a physical reaction before it creates a legal one. Your chest tightens, your thoughts race, and you wonder whether the receiving bank can still see the money. The answer depends on what happened after settlement. A domestic wire may still be reachable if the receiving bank hasn't credited or released the funds. An international transfer may still qualify for a federal freeze request, but only if it meets strict conditions.

Practical rule: Report the fraud first. Verify the full story after the banks and law enforcement have begun trying to preserve the funds.

The first call should go to the originating bank's wire or fraud department. Ask for an immediate recall and a hold request at the receiving bank. A recall isn't a guaranteed reversal. It's an urgent request for the other institution to cooperate before the beneficiary withdraws, forwards, or converts the money.

For international wires, the FBI's specific International Financial Fraud Kill Chain requires an international transfer of at least $50,000, a report within 72 hours, and a SWIFT recall already issued by the sending bank, as explained in this 72-hour wire recovery playbook. Missing any condition removes that particular recovery channel.

The clock doesn't create a precise recovery percentage for every passing hour, and no responsible lawyer should promise one. It does create a steadily worsening position. Every delay gives the beneficiary more time to move the money beyond the first account, and each additional institution or jurisdiction makes a freeze harder.

The same discipline used in broader fraud prevention requires balancing security and customer experience, but once a wire has left your account, security must take priority. Use the immediate steps below, and review how to recover from fraud for related recovery considerations.

Immediate Actions to Maximize Recovery

Don't start with your local branch, a relationship manager, or a general customer-service queue. Call the originating bank's fraud department, wire operations team, or commercial client services line and say plainly that you're reporting a fraudulent wire.

Make the bank call precise

Have these details in front of you:

• Wire reference: Provide the transaction or confirmation reference, including any IMAD or OMAD information shown on the confirmation.
• Beneficiary details: Give the beneficiary's name, account number, receiving bank, routing information, and any intermediary bank listed.
• Transaction timing: State the exact amount and the exact date and time the wire was sent.
• Nature of the fraud: Explain whether the instruction came from a spoofed vendor, compromised email, imposter advisor, romance scam, or investment platform.

Ask the bank to initiate a SWIFT MT103 recall message where applicable and to send a beneficiary hold request at the same time. The MT103 is the transaction message used to communicate the recall through the banking network. The hold request asks the receiving institution to stop pending credits or outbound movement while it investigates.

Do not accept “we opened a ticket” as the end of the call. Ask for the case number, the responsible department, confirmation that the recall was transmitted, and the name or identifier of the person handling the escalation.

Create a written record

Submit the bank's fraud affidavit or written fraud declaration immediately. Then send a written follow-up summarizing your call, the time you reported the fraud, the recall request, and the information provided. Keep copies of every message and attachment.

Preserve the spoofed email in its original form, including full headers. Don't forward only a screenshot. Forwarding can strip information investigators may need to understand how the message reached you.

Report to federal intake

File a detailed complaint with the FBI's Internet Crime Complaint Center at IC3.gov. Include the wire details, beneficiary information, email evidence, and timeline. The complaint gives federal investigators an intake record that can support coordination with banks and, when the conditions are met, the Financial Fraud Kill Chain.

If you know the receiving bank, contact its fraud department after your originating bank has begun the recall. You're asking for preservation and escalation, not arguing with a front-line representative. Don't contact the fraudster again. Further communication can alert the person that the funds are being traced.

Domestic Wire Recall vs International Kill Chain

A domestic wire and an international fraud case require different escalation paths. A domestic recall runs through the originating and receiving banks. An international case may require SWIFT communication, correspondent-bank action, and federal coordination. Choose the path based on where the funds moved, not where the fraudster claimed to be located.

For a domestic transfer, press the originating bank to send the recall immediately and identify the receiving bank's fraud or payment-operations team. The receiving institution may still be able to restrict the beneficiary account, stop a pending outbound payment, or preserve funds. Once the money leaves that account, the bank's practical ability to help drops sharply, and recovery may require the recipient's cooperation or legal action.

The guidance on fraudulent wire transfers recommends contacting both the sending bank and the bank that may have received the funds, while expressly requesting a wire recall. Do not settle for a general fraud ticket. Ask whether the recall was transmitted, where the funds were sent next, and which department is handling the receiving-bank escalation.

Know whether the Kill Chain applies

The Kill Chain conditions are outlined above. In practice, confirm four points with the bank: the transfer crossed an international border, the stolen amount meets the applicable threshold, the report is within the required window, and the sending bank has issued a SWIFT recall. If any condition is missing, ask the bank what other recovery or preservation process it will use.

The Kill Chain can help preserve funds through coordinated intervention, but it does not guarantee repayment. If a foreign institution freezes the money, additional legal procedures may still be required before it can be returned, including civil forfeiture or mutual legal assistance.

Speed remains the decisive advantage. In the FBI recovery data summary, the reported process handled nearly 3,900 fraud cases involving $1.16 billion in stolen transfers and froze $679 million, a 58% success rate. Those figures describe funds frozen through that process, not money every victim ultimately receives. Treat them as evidence that rapid escalation matters, not as a recovery promise.

Documentation and Evidence Checklist

Your evidence package should let a bank investigator understand the transaction without calling you back for basic facts. A weak record can slow a recall, confuse an IC3 submission, and undermine a later claim.

Preserve the transaction trail

Save the wire confirmation, account statement, payment approval record, and all available transaction identifiers. If the bank can provide an IMAD, OMAD, SWIFT MT103, correspondent-bank information, or beneficiary-account record, request it in writing.

Keep the original email files and full headers. Screenshots help show what you saw, but headers can help investigators assess routing and authentication information. Preserve texts, messaging-app conversations, chat logs, invoices, payment instructions, call records, and calendar entries.

If the fraud involved an investment website, trading portal, romance profile, or social-media account, capture screenshots and export records where possible. Don't log in repeatedly or change the account before preserving what's visible.

Build a clean chronology

Write a timeline while the events are fresh:

• First contact: Record when and how the fraudster approached you.
• Instruction changes: Identify when the beneficiary or payment details changed.
• Authorization: Note who approved the wire and what information they relied on.
• Discovery: Record when you learned the payment was fraudulent.
• Notifications: List each call, email, complaint, and recall request with its time.

Bank investigators and the FBI's IC3 intake need concrete transaction facts. A brokerage statement guide can also help when the transfer originated from an investment account or appears on a securities account record.

Treat preservation as legal hygiene. Don't delete suspicious messages, negotiate with the fraudster, or “clean up” the mailbox. Your bank, insurer, counsel, and law enforcement may need the original record, not an edited narrative.

When the Wire Goes Through a Brokerage or Advisory Account

A wire that touches a brokerage or advisory account creates a different recovery question. The issue may no longer be only whether a bank can recall a payment. It may involve an unauthorized disbursement, account takeover, an imposter advisor, inadequate supervision, or a financial professional who directed funds improperly.

Start by separating authorization from misconduct. If someone accessed your account and initiated the wire without permission, the dispute centers on unauthorized activity and account security. If you authorized the transfer because a registered representative or adviser gave you false information, the bank may characterize the payment as authorized, but a securities claim may still exist against the professional or firm.

That distinction matters because the bank generally won't investigate broker supervision, suitability, fiduciary duties, or the firm's handling of red flags on your behalf.

Examine the brokerage relationship

Identify the account type, the firm involved, the representative's registration, and the destination of the funds. A brokerage account and an advisory account can create different duties and dispute procedures, as outlined in this comparison of advisory and brokerage accounts.

A custodian such as Schwab, Fidelity, or Pershing may have an anti-money-laundering department capable of reviewing suspicious inbound transfers. It may also preserve records, restrict activity, or coordinate with a receiving institution. Those steps are operational remedies, not a determination that the firm owes reimbursement.

Compare the legal lanes

FINRA Rule 11800 customer arbitration may be relevant in a dispute with a broker-dealer, but it doesn't automatically apply to every adviser, platform, or bank. A lawyer must assess the account agreement, the parties, and the conduct before selecting a forum.

Working With Banks, Law Enforcement, and Counsel

A serious case runs on three workstreams at once. The bank tries to recall or contain the payment. Law enforcement evaluates the fraud and coordinates where appropriate. Counsel preserves legal claims, demands records, and prevents an early settlement or release from ending the case prematurely.

The bank's investigator needs accurate transaction data, a clear fraud description, and proof that you acted promptly. IC3 provides centralized intake, while a local FBI or Secret Service field office may conduct interviews or pursue investigative leads. Those channels don't move at the same pace, so keep your own log of every report and reference number.

Where counsel adds leverage

A securities or consumer-fraud attorney can do more than repeat your phone call to the bank. Counsel can send a formal demand that identifies the legal theory, preserves claims, and directs the institution to retain relevant records.

Depending on the facts, counsel may evaluate:

• Regulation E issues: Whether the transaction qualifies as an unauthorized electronic fund transfer.
• UCC Article 4A defenses: Whether the bank followed agreed security procedures and payment instructions.
• Brokerage liability: Whether a firm or adviser ignored warning signs, mishandled an account takeover, or supervised personnel inadequately.
• Third-party discovery: Whether subpoenas or litigation tools can identify the beneficiary account holder or trace transferred funds.
• FINRA procedure: Whether a demand letter or arbitration filing can bring a broker-dealer into a structured recovery process.

A bank's refusal to reimburse you isn't the same as a final determination that nobody else is liable.

Fee arrangements should match the case. A contingency arrangement may fit a substantial securities claim with identifiable defendants and recoverable assets. An hourly retainer may be appropriate for urgent investigation, a complex business loss, or litigation requiring substantial early work. A flat-fee demand package can make sense when the immediate objective is a focused bank or brokerage demand rather than full representation.

Kons Law handles investment-loss and wire-fraud disputes through securities litigation, FINRA arbitration, and court actions. Its bank litigation practice is one possible resource when the facts point beyond a routine recall request.

Realistic Outcomes and Your Next Step

Recovery depends on the payment path, the reporting speed, and whether the money remains traceable. Don't let a hopeful bank employee or an aggressive recovery company turn a possibility into a promise.

The FBI's recovery figures show that coordinated freezes can be substantial. The 2023 benchmark involved $538.39 million held from $758.05 million in fraudulent transfers, while the later summary involved $679 million frozen from $1.16 billion. Those results support urgent action, but they don't establish that every victim will receive the same result.

A 2025 CertifID-based summary reported that 73% of wire-fraud victims recovered all or most of their funds, while 27% recovered less than half or nothing, according to this wire fraud recovery analysis. The same source cites a 2022 consumer recovery dataset in which the average consumer recovery loss was $106,557, and consumer recovery success rates were only one-third those of real estate firms. Individual investors and homebuyers should therefore assume that full reimbursement is uncertain once funds leave the original account.

Use this decision tree

• If the wire was discovered today: Call the originating bank's wire department, demand a recall and beneficiary hold, then file the IC3 complaint.
• If the wire was international and at least $50,000: Confirm that the SWIFT recall was issued and report within 72 hours so the specific Kill Chain channel remains available.
• If the money touched a brokerage, advisory account, or investment platform: Preserve the account records and consult securities counsel before signing a release.
• If the beneficiary account has already been emptied: Continue with IC3, bank escalation, insurance notification, and legal analysis, but expect a more difficult recovery effort.
• If the funds moved into crypto or through multiple jurisdictions: Treat recovery as a tracing and litigation problem, not a simple recall.

A financial institution's broader cyber defense for financial institutions can reduce future exposure, but it won't replace the steps required after money has already moved.

Call your bank and file the IC3 complaint today, even if you're embarrassed or unsure whether the payment was fraudulent. If the wire touched a brokerage, adviser, or investment platform, don't sign a release or accept a final denial before a securities attorney reviews the records.

If you'd like a free consultation about the investment loss recovery process, call Kons Law Firm at (860) 920-5181 for a FREE, NO OBLIGATION consultation. Kons Law evaluates potential claims involving wire fraud, broker or adviser misconduct, and FINRA arbitration, and you can also visit Kons Law to request a review of your situation.