Minute 1: stop and confirm
The moment a fraudulent wire is suspected, the first step is confirming it, not immediately calling the bank in a panic. Pull up the transaction, verify the destination account against what should have been confirmed, and get one other person involved immediately. A second set of eyes catches mistakes a stressed first responder can miss.
Hour 1: call the sending bank
Contact the bank that sent the wire and request a recall as early as possible. Recovery success rates drop sharply after the first 24 hours, so this call shouldn't wait for a full internal investigation to conclude first. Have the wire confirmation number, the amount, the date and time, and the destination account details ready before you call.
Hour 4: file with law enforcement
Report the incident to the FBI's Internet Crime Complaint Center (IC3.gov) as soon as possible. Law enforcement involvement, particularly quickly, meaningfully improves the odds of freezing funds before they move further. Local police can also be notified, but IC3 is the channel built specifically for this.
Day 1: document everything
Once the immediate response is underway, start documenting: every email in the thread, every phone call, timestamps for each action taken. This record matters for the bank's investigation, for any insurance claim, and for understanding exactly where the process broke down.
The following weeks: review and adjust
After the immediate response, review what happened. Where did the fraudulent instruction get treated as legitimate? What verification step, if it had existed, would have caught it? A response plan that doesn't feed into a prevention update is only solving half the problem.
Why having this written down in advance matters
None of the steps above are complicated, but under real pressure, people forget steps, waste time deciding who's responsible for what, or hesitate before making the first call. A plan written down in advance removes that hesitation exactly when it costs the most.
- How quickly does a wire recall need to be requested to have a chance of working?
- As soon as possible. Recovery odds drop substantially after the first 24 hours, so the recall request shouldn't wait for a full internal review.
- Who should be responsible for filing the IC3 report?
- Whoever owns fraud response internally should have this assigned in advance, so it doesn't get delayed by uncertainty about ownership during an actual incident.