Wire Fraud: What to Do in the First 48 Hours

Hour 0–1: Call your bank's fraud line

Not your relationship manager — the fraud department, on the number from your account portal or card, never from any email connected to the incident. Say the words "fraudulent wire transfer" and "recall request." Ask them to: (1) initiate a recall/reversal request to the receiving bank immediately, (2) contact the beneficiary bank's fraud team directly, and (3) freeze or monitor your account for further pending payments — fraudsters who succeeded once often have more transfers queued. Write down the time of your call, the agent's name, and your case number. You will need all three repeatedly.

Hour 0–2: File with IC3 (US) — this is what triggers the FBI freeze process

File at ic3.gov with the exact transfer details: amount, date, your bank, the receiving bank, account number, and beneficiary name from the wire instructions. For qualifying fraudulent transfers reported quickly, the FBI's Recovery Asset Team can initiate the Financial Fraud Kill Chain — a rapid coordination process with banks to freeze the funds before they disperse. This process exists specifically for fast reports; it is the single best reason not to spend the first day deliberating. Full walkthrough: what IC3 is and what happens after you file. For losses over $50,000, also contact your local FBI field office directly.

Hour 2–8: Preserve everything, change nothing

Do not delete, forward, or "clean up" anything. Preserve: the emails or call records that carried the instructions (with full headers), the wire confirmation, the vendor record as it currently stands, and access logs if a mailbox may be compromised. If the fraud arrived through email, assume the mailbox is still compromised: have IT revoke sessions and reset credentials for affected accounts after preserving evidence, and check for hidden forwarding rules — attackers routinely add them to monitor your response.

Hour 8–24: Notify your insurer and freeze related payments

Crime and cyber policies carry prompt-notice clauses; late notice is a common reason claims fail. Notify in writing even if details are incomplete. In parallel, freeze any pending payments touching the same vendor, requester, or instructions, and verify — by callback to numbers on file — any payment-detail change made in the past 90 days. Wire fraud rarely travels alone; see invoice fraud for the adjacent pattern.

Day 2: Report widely and open the internal review

File with the FTC at reportfraud.ftc.gov (US) or Action Fraud (UK). Notify your other banks if credentials or processes may be exposed. Then start the honest internal review: which control failed — and specifically, was a callback to a number on file performed? The answer determines both your insurance conversation and your fix. What recovery realistically looks like from here: wire transfer fraud recovery.

What not to do

Do not pay anyone who contacts you offering to recover the funds — the recovery-services space is heavily populated by secondary scammers who target recent victims. Do not confront the fraudster or reply to the original thread; it tips them to move the money. And do not let the person who processed the payment be scapegoated — the process failed, not the person, and your next hire will process payments too.