1. Call your bank. Now.
Call the bank’s wire or fraud line on a number you already have, not one in the email that sent the instruction. Ask for a recall of the funds.
The FBI’s words: “time is of the essence. Immediately, contact your financial institution and request a recall of the funds” (IC3, 2025, p. 17).
2. File with the FBI the same day, whatever the amount.
File a complaint at ic3.gov. Include the amount, the date, the sending and receiving banks, the receiving account number and the wire reference. The FBI asks for a complaint “regardless of the amount lost.”
The complaint is what lets the FBI’s Recovery Asset Team work with the banks to freeze the money. In 2025 it acted on 3,900 incidents and froze $679,013,183 of the $1,163,919,846 attempted, a 58% success rate (IC3, 2025, p. 17).
3. If the wire went abroad, the same complaint reaches FinCEN.
FinCEN’s Rapid Response Program works with foreign partners to stop money sent overseas. You do not call FinCEN: the program starts when law enforcement reviews your IC3 complaint and refers it. FinCEN asks victims not to contact it directly.
The chance is best when the wire is “reported to law enforcement within 72 hours of the transaction.” Since 2015 the program has interdicted $1.8 billion and recovered more than $1 billion (FinCEN, April 2026).
Then: keep the record, and tell the principal
Keep everything. The email with the instruction, the confirmation of the wire, every reply. Delete nothing: the bank and the FBI will ask for it.
Stop using the channel the instruction came through until the people who run the office’s email have looked at it.
Tell the principal the same day, in writing. What happens next is the family’s decision, and it cannot be made on news that arrives late.
The scale
The FBI recorded 24,768 business email compromise complaints in 2025, with losses of $3,046,598,558 (IC3, 2025, p. 7 and 8). The scheme uses an email that is compromised or impersonated to ask for a payment, or for new bank details on a payee (FinCEN FIN-2019-A005, 2019).
Write this page before you need it
On one page, kept where the person who sends wires can find it without email:
- Each bank, its wire or fraud line, and the account officer’s name and number.
- Who in the office makes the call, and who calls if that person is away.
- The details to have ready: amount, date, both banks, receiving account, reference.
- The address to file at: ic3.gov.
It is the same one-page test as Note 6: a task nobody does often, which has to work the first time.
What stops it happening
Two controls, both cheap. A second person approves every new or changed payee. And a call back, on a number already on file, before any new instruction is used. NIST’s standard is that no single person both initiates and approves a transaction, executives included (NIST IR 7621 Rev. 1). Note 3 gives the test, bank by bank.