Wire fraud recovery: first 72 hours.
If your company sent a wire to a fraudulent account, do not wait for a meeting. Call the originating bank now, request a recall or hold, file with FBI IC3, and preserve every record that shows how the instruction happened.
Last reviewed May 2026 / Vicall Research / Not legal advice
Run bank recovery and evidence preservation in parallel.
The employee who sent the wire may feel embarrassed or scared. Do not waste time assigning blame. Recovery depends on speed and complete records.
Call the originating bank's fraud team.
Ask for an urgent wire recall, reversal attempt, or hold. Ask the originating bank to contact the receiving bank. Document the case number, time, and person you spoke with.
File with FBI IC3.
Report at ic3.gov. Include transfer amount, timestamp, sending and receiving banks, account and routing/SWIFT details, phone numbers, emails, invoices, and payment instructions.
Preserve the instruction chain.
Save the call log, voicemail, email headers, text messages, invoice, vendor bank-change form, approval ticket, and any internal chat where the payment was discussed.
Notify counsel and insurance.
Commercial crime, cyber, E&O, D&O, and professional liability policies may have notice requirements. Counsel can also help assess breach notification and privilege.
Pause similar payments.
Freeze high-risk payments until you know whether the attacker changed a vendor record, compromised an account, cloned a voice, or exploited a phone verification gap.
How the wire usually gets redirected.
Vendor bank change
A caller or email claims a supplier has new banking details. AP updates the record and pays the real invoice to the wrong account.
Executive instruction
A fake CEO, CFO, partner, or owner creates urgency around a confidential wire and pressures finance to move before verification.
Closing or escrow instruction
A buyer, title company, law firm, or real-estate party receives a changed wire instruction just before closing.
Voice clone call
An attacker uses a cloned voice to make the instruction feel familiar and safe, especially when the real person has public audio online.
Payroll redirection
An employee or executive is impersonated to change direct deposit or trigger an off-cycle payment.
Compromised email plus phone
The attacker uses email for documentation and a phone call for pressure, defeating controls that only inspect email.
Fix the workflow that let the payment move.
Payment controls to add
- Verified-directory callbacks for all vendor bank changes
- Dual approval for wires and urgent exceptions
- Pre-shared passphrases for phone-authorized payment changes
- Waiting period for new beneficiary accounts
- Separate approval channel for executive payment requests
Phone controls to add
- Voice-clone detection for teams that approve payments
- Risky-phrase alerts for wire transfer, routing number, and account number
- Training that tells employees to hang up and verify
- Blame-free incident reporting so near misses surface fast
- MSP-managed deployment for client companies with payment exposure
Recovery steps by business type.
The bank and IC3 steps are universal. Notification obligations differ by industry, insurer, contract, and regulator.
Start with the FBI and your bank.
The FBI's BEC guidance tells victims to contact their financial institution immediately and request that it contact the receiving financial institution. IC3 is the reporting path for internet-enabled fraud.
Wire recovery questions.
Can a business recover a fraudulent wire transfer?
Sometimes. Recovery depends on timing, receiving-bank cooperation, whether funds are still in the destination account, and whether the transfer has moved through additional accounts. Call the bank and file IC3 immediately.
Should we call the receiving bank ourselves?
Start with the originating bank because it can initiate the formal recall or hold request. If your bank gives you instructions to contact the receiving institution or law enforcement, follow those instructions and document every call.
How does phone protection prevent wire fraud?
Many wire fraud events are approved after a live call. Vicall adds detection during that call: synthetic-audio scoring for voice clones and optional alerts for phrases like wire transfer, routing number, account number, verification code, and urgent payment.
Stop the next wire before it becomes recovery.
Vicall protects the live call where fraudulent wire instructions often get approved.