What should I do after a fraudulent business wire?

If your business has wired money to a fraudulent destination, contact the sending bank immediately through a verified route. Report the suspected fraud, request a recall and ask what information or documents the bank needs. Report the incident promptly to the FBI's Internet Crime Complaint Center, IC3. Preserve the transfer and message records while the appropriate people address any continuing compromise.

Do not wait for a polished internal report before making the bank call. But do not mistake the call for recovery either. Requested, located, frozen and returned funds describe different states, with different consequences for the cash your business can actually use.

Start with the bank that sent the money

The FBI's business email compromise guidance directs victims to contact their financial institution immediately and ask it to contact the institution where the transfer went.

Use contact information established independently of the suspicious message. Give the bank the actual transfer reference, amount, date and relevant destination information through its appropriate secure process. Tell it that the destination is suspected to be fraudulent rather than merely saying a supplier has not acknowledged payment.

Ask who is handling the request, what the bank has initiated and what remains necessary from your business. Record the case reference and time. If an initial contact cannot handle a wire-fraud report, ask for the responsible team through the bank's established escalation process.

Do not send another transfer to correct the first one based on instructions from the same disputed channel. A purported return fee, test payment or emergency replacement account needs independent verification, not the authority created by your urgent wish to fix the mistake.

Request recall without inventing a right to reversal

An IC3 public service announcement recommends requesting a recall and any necessary indemnification documents. It notes that financial institutions have different policies and that IC3 may be able to assist with freezing funds.

Ask what assistance your bank can actually provide. A request does not establish that the recipient institution still holds the money or that it will be returned. Do not describe a recall reference number as a refund confirmation.

This guide concerns an already-sent business wire, not every consumer payment method. A card dispute, payment-app transfer, international consumer remittance or ordinary mistaken payment can involve different rights and processes. Identify the real transaction rather than applying an internet cancellation rule to anything called a transfer.

Act promptly even if time has passed. The official advice to contact the bank immediately is not a promise of recovery within a particular number of hours, or evidence that reporting later is pointless.

Give reporting and evidence their own owner

The FBI and IC3 direct businesses to report business email compromise through IC3's official site. Follow its actual current instructions and preserve your copy and reference. A report is information for the appropriate authorities; it is not a recovery approval or a guarantee of an individual response.

If capable authorized people are available, bank contact, reporting and technical response can proceed alongside each other. State who owns each task. Do not have three employees independently making inconsistent claims or assuming that another person has already filed.

Preserve the original messages, attachments, transfer confirmation, payment instructions and relevant existing supplier records. Keep the chronology of discovery and each response. A later summary should point to the originals rather than replace them.

Distinguish observations from conclusions. A message appearing in an existing thread does not establish whose account was compromised. Record what is known and let the appropriate investigation establish the cause.

Stop the next loss without destroying the record

Activate the business's authorized security response where an account, device or payment process may be compromised. Have qualified personnel establish appropriate containment and preserve evidence. Avoid an improvised cleanup that deletes relevant messages or leaves another unauthorized payment route active.

The customer-data response guide addresses a different incident output: establishing exposure scope and related obligations. A fraudulent wire may or may not also involve such an exposure. Do not announce a data breach, or announce that no breach occurred, without the relevant findings.

Tell the people with payment authority which instruction or destination is disputed and which actions are on hold. Keep legitimate business operations running through verified processes where appropriate. A clear targeted hold is more useful than a vague warning that every supplier message is now untrustworthy.

If customer, supplier, insurer or other notification duties may apply, have them identified promptly by the responsible people. The bank call does not necessarily discharge those separate obligations. Use supported facts and actual deadlines.

An original cash record after the wire

Consider an invented business with $20,000 in bank cash before an incident. It sends $12,000 to a fraudulent destination, leaving $8,000. In this case the bank confirms the transfer occurred; it is not merely a pending instruction.

The business immediately reports the fraud through the proper routes. The actual supplier independently confirms that it received none of the money. Under this case's established agreement and reviewed facts, its genuine $12,000 invoice remains entirely owed, with no credit or other change.

Another $4,000 of the remaining bank cash is protected for separate obligations. Only $4,000 is available for the supplier without using those protected resources. Against the $12,000 still owed, the immediate gap is $8,000.

These are original teaching inputs, not a real company's incident, a conclusion about every mistaken-payment dispute or a statement that the business must immediately pay twice under all contracts. The supplier obligation is expressly established in this particular case.

Frozen is not returned

On day one of the fiction, the bank reports that $4,000 has been frozen at the recipient institution. No money has yet returned to the business. Its bank balance remains $8,000, not $12,000.

The business should record exactly what the bank confirmed and what remains necessary. A reported freeze may be important progress, but it does not establish a date when the sender can use the money. Do not enter it in available cash merely because the amount is identified.

In a later completed branch, the bank confirms an actual $4,000 return on day four, and the business's own account record shows the credit. Cash then rises from $8,000 to $12,000.

Those dates are invented outcomes, not a bank processing promise or an expected recovery schedule. The earlier freeze and later return refer to the same $4,000. Adding both as recoveries would double-count one amount.

Rebuild the remaining gap

After the actual return, the $12,000 bank balance still contains the protected $4,000. Available supplier money is therefore $8,000, leaving a $4,000 gap against the established $12,000 obligation.

The supplier was due on day two in this fictional record. The day-four return did not retrospectively fund that earlier payment. An actual agreed arrangement or other available resource would have been needed; no such arrangement is supplied here.

Gross fraudulent money sent was $12,000. Money actually returned is $4,000, leaving $8,000 of principal unrecovered. That is different from the current $4,000 supplier-funding gap, which also depends on the business's other starting cash and protected obligations.

Response costs, possible fees and other consequences have not been priced in this limited principal-and-cash record. The stated gaps are not a complete incident budget; additional required payments could make them larger. No insurance proceeds or other recovery has been approved or received in this example.

Do not turn a request into a second recovery

Keep the original transfer, bank return, insurer correspondence and any other potential compensation linked to the same loss. Ask the appropriate reviewers how actual recovery rights and allocations interact.

A bank recall request and an insurance claim are not two cash receipts. Nor is a hoped-for reimbursement usable funding for a dated supplier payment. Record approvals, conditions, deductions and actual receipts only as those facts become established.

If money returns after another party has compensated the loss, coordinate the actual consequences rather than treating every credit as free additional recovery. The bookkeeping and tax treatment also need the real records; this guide does not declare the unrecovered amount a deductible expense.

Once the bank's position is clear, check for any later change or residual recovery through the established case. Preserve history instead of overwriting the original transfer as though it never occurred.

Be ready for the recovery scam

The FTC warns about refund and recovery scams targeting people who have already lost money. An unsolicited caller may promise recovery in exchange for an advance fee or sensitive information, sometimes claiming government connections.

Do not pay a stranger to unlock a refund, route money through another account or buy a place in an alleged recovery queue. Verify any claimed official contact through an independently established agency route.

That warning is different from selecting qualified technical or legal help for a defined response scope through your own verified process. A genuine professional can charge for actual work without guaranteeing that stolen funds will come back. Establish identity, authority, scope and fees rather than confusing a promised recovery with a service engagement.

Repair the payment process after the urgent work

When appropriate, review how the instruction reached payment, what was independently verified and what authority each person exercised. Identify the actual failure before blaming an individual or buying another tool.

The payment-change verification guide owns the preventive step: checking a new destination through an independent established contact. Use it to repair that part of the process without pretending prevention advice recovers money already sent.

Close each task with evidence: bank status, reporting record, authorized containment, actual recovery, verified remaining obligations and necessary follow-up. The incident can have unresolved money even after operations resume. Keeping that open amount visible is more useful than calling the whole matter finished because a recall was requested.