How do you recover a wire transfer lost to business email compromise?

If your business just wired money to an account a criminal supplied by email, stop reading articles and call your bank's fraud line. Then come back. This guide covers what happens after that first call: the exact requests to make, how the FBI and FinCEN try to freeze funds, what to put in the complaint, and how to find out how the attacker got in.

Business email compromise (BEC) is fraud in which a criminal poses as a supplier, executive, lawyer or customer by email to redirect a payment. Our BEC prevention guide covers how to stop it; this one is only about recovery.

What should you do right now?

Do these in order. Don't wait to finish one investigation step before starting the next call.

1. Call your bank's fraud or wire department. Use the number on your bank's website or card, not one from any email. Ask for a recall or reversal of the transfer, and for a Hold Harmless Letter or Letter of Indemnity, as the FBI's IC3 advises.
2. File a complaint at ic3.gov. Type the address yourself. The IC3 says it's "vital the complaint contain all required data in provided fields, including banking information."
3. Stop every other pending payment to the same new account, and freeze changes to vendor bank details.
4. Secure the mailboxes involved. Reset passwords, sign out all sessions and remove unknown inbox rules (details below).
5. Call the real supplier or executive on a number from your own records. Tell them their name was used, and ask whether their mailbox might be compromised.
6. Preserve evidence. Keep the emails with full headers, the invoice, the wire confirmation and the bank's reference number.
7. Tell your insurer if you have cyber or crime cover. Many policies have short notice deadlines.

Can you get the money back after a BEC wire?

Sometimes, but only if the money is still in the receiving account when the bank acts. Criminals usually move funds on quickly, so time is the deciding factor. FinCEN's Rapid Response Program fact sheet says it is "most likely to be able to interdict or recover funds when fraudulently induced wire transfers are reported to law enforcement within 72 hours of the transaction."

The FBI's own results show both the chance and the limits. According to the IC3's domestic kill chain brochure, from January 1 to December 31, 2025 the Recovery Asset Team handled 3,574 domestic incidents with $832,965,941 in losses and froze $507,042,623, which IC3 reports as a 61% recovery rate. Frozen money isn't the same as money returned to you; the return still runs through the banks. Across all 2025 incidents, domestic and international, the 2025 IC3 Annual Report says the team initiated 3,900 kill chain incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate.

No one can promise you a recovery. Anyone who does is a red flag (see the recovery scam section below).

What should you ask your bank?

Your bank (the "originating" bank) is the only party that can formally ask the receiving bank to send the money back. Be specific. This is an example of what to say or send:

Example message to your bank's fraud team We are reporting a fraudulently induced wire sent on 2026-11-02, reference 0000000, for $48,250.00 to account 000000000 at Example Bank, ABA 000000000. We were deceived by an email impersonating our supplier. Please (1) initiate a recall/reversal immediately, (2) contact the beneficiary bank to request a freeze, (3) tell us what Hold Harmless or indemnity documents you need from us, and (4) give us your case number and the SWIFT reference if this was international.

Ask what help the bank offers; the FBI notes in its 2025 annual report that "different financial institutions have varying policies." Ask too whether any other recent payments went to the same beneficiary.

Does it matter how the money was sent?

Yes. Each payment rail has different recall options, so tell the bank exactly how you paid.

The ACH detail comes from Nacha's 2026 fraud monitoring rules. They define "False Pretenses" as inducing a payment by misrepresenting a person's identity, their authority to act for someone else, or the ownership of the account to be credited, which is what a BEC payment redirection is.

How does the FBI's Recovery Asset Team try to freeze funds?

The IC3 Recovery Asset Team (RAT) was set up in February 2018 to work with banks and FBI field offices to freeze money sent to accounts under fraudulent pretenses. Its process is called the Financial Fraud Kill Chain (FFKC). Your IC3 complaint is the trigger, which is why filing quickly with full details matters.

The IC3 doesn't publish its exact thresholds. Don't skip filing because you think your loss is too small; the FBI's 2025 annual report says to file "regardless of the amount lost." FinCEN also asks victims not to contact FinCEN directly. Go through your bank and law enforcement.

What information goes in the IC3 complaint?

A complete complaint is one the RAT can act on without chasing you. FinCEN lists what is required when you file with law enforcement for a foreign wire, and the same details help a domestic case:

• Your account name and number, and your bank's name
• The country of your bank's branch that sent the payment
• A short summary of the fraud
• The beneficiary's account name and number, and the beneficiary bank's name
• The country of the branch that received the funds
• The date of the wire, the currency and the amount

FinCEN also asks banks for the SWIFT reference and any correspondent or intermediary bank details. Add the fraudulent email addresses, the lookalike domain if one was used, phone numbers the criminal gave you, and the invoice. Write down your IC3 complaint number and give it to your bank.

How did the criminal get in?

You need to know whether the fraud came from your mailbox, your supplier's, or a fake domain. The answer decides whether the attacker is still inside your systems. Start with the fraudulent email and look at its headers; how to read email headers explains each field, and our free Email Header Analyzer runs in your browser.

If one of your mailboxes was compromised

Attackers often add inbox rules that hide replies from the real supplier, so the fraud stays invisible. Check for them (malicious inbox rules and auto-forwarding), reset the password, revoke sessions and re-register MFA. Platform-specific steps are in Microsoft 365 compromised account remediation and Google Workspace compromised account recovery. Search for other messages the attacker sent from the account; there may be more than one fake invoice. On Microsoft 365, message trace shows what went out.

Who else should you notify?

Make these calls the same day:

• The impersonated party, on a known number. If their mailbox is compromised, they need to secure it and warn other customers.
• Your insurer or broker, before you sign anything the bank or anyone else sends.
• Your attorney. A compromised mailbox may have exposed personal data, and notification duties depend on your state, industry and contracts. We can't give legal advice; counsel can.
• Your accountant, so the loss and any recovery are recorded correctly.
• Staff who handle payments, so a second fake invoice doesn't get paid while you deal with the first.

Beware of fund recovery scams

Victims who report fraud become targets again. In July 2026 the FBI warned that criminals impersonate the IC3 itself, using fake profiles and a spoofed site. Its PSA is clear: "IC3 will never ask for payment to recover lost funds," it won't refer you to a company that charges for recovery, and it "does not maintain a social media presence." File only at ic3.gov, typed into your browser. Treat any unsolicited offer to recover your money, especially one that wants a fee up front, as another scam.

What should you change after a BEC loss?

Once the urgent work is done, fix the process that let the payment through:

1. Require a call-back to a number already on file before changing any vendor bank details. Our vendor invoice fraud guide has a ready-made procedure.
2. Require two people to approve new payees and large transfers.
3. Turn on MFA for every mailbox, and prefer phishing-resistant methods such as passkeys.
4. Enforce DMARC on your own domain so criminals can't send as you exactly; check yours with the DMARC Checker.
5. Watch for lookalikes of your domain and your key suppliers' domains with the Lookalike Domain Generator.
6. Run a short lessons-learned review using your email security incident response plan.

Inbound filtering helps as well. iBlockSpam protects small businesses with MX-level filtering that includes phishing and spoofing protection, and Lookalike Domain Watch alerts you when a domain resembling yours is registered or gets a mail server.

Next steps

• If money left in the last 72 hours: call your bank, then file at ic3.gov. Everything else can wait an hour.
• Save the fraudulent email with full headers and check where it came from with the Email Header Analyzer.
• Check the mailboxes involved for forwarding rules and unknown sign-ins.
• Write the call-back and dual-approval rules into your payment procedure this week.
• If you run a small team without in-house IT, see how iBlockSpam protects small businesses.