Act immediately if a wire may be fraudulent.
The first call is to the financial institution that sent the wire. Ask about a recall or reversal right away; no service can promise to recover the funds.
First-hour actions
Call the originating bank immediately
Tell its fraud team the transfer may be fraudulent and request a recall or reversal. Ask what documentation it needs. Do not delay while investigating the email yourself.
Preserve the evidence
Keep the email thread, headers, payment confirmation, timestamps, beneficiary details, and any messages with your bank. Limit distribution of account numbers.
File an IC3 complaint
Report the incident through the FBI's Internet Crime Complaint Center with accurate transaction details. Follow instructions from your bank and law enforcement.
Secure potentially compromised mailboxes
Have your IT or security lead review sign-ins, forwarding rules, filters, and third-party app grants. Reset credentials and sessions using a trusted device if compromise is suspected.
Pause related payments
Notify authorized approvers and verify any pending invoices or vendor changes through independent, known channels.
Do not trust recovery guarantees
Ask your bank whether a recall is possible; the outcome depends on the transaction and timing. Be wary of anyone promising guaranteed recovery for a fee.
Sources: FBI IC3: BEC response and FTC: what to do if you were scammed.
Email the payment-change checklist to your team.
No bank details or sensitive emails. You can read the checklist without submitting this form.
Want the workflow instead of another article?
Get the Business Email Compromise Defense Pack, request a free teardown, or download the checklist and capture the process for your team.