We Sent Money to a Fraudulent Bank Account: Can We Get It Back?

If your business has sent money to a fraudulent bank account, the single most important factor for recovery is speed. The chances of getting your funds back decrease dramatically after the first 24-48 hours. While recovery is not guaranteed, taking immediate and decisive action can make a significant difference.

This situation is a common outcome of Business Email Compromise (BEC), where an attacker gains access to an email account to deceive your team into misdirecting funds. The criminals are prepared to move the money out of the fraudulent account the moment it arrives, often transferring it overseas or into cryptocurrency, where it becomes nearly impossible to trace.

If you have sent funds to a suspected fraudulent account, stop reading and call our 24/7 incident response hotline now at /business-email-compromise.

First Steps to Recovering Fraudulently Sent Funds

Time is the most critical variable. Do not wait to confirm suspicions or spend hours investigating the email chain. Execute these steps immediately, in this order.

1. Contact Your Bank Immediately. Call your bank’s fraud department directly. Use the phone number on the back of your debit card or on a recent statement. Do not use contact information from an email, as it could be compromised. Inform them that the wire transfer or ACH payment was fraudulent. Provide the transaction details: date, amount, recipient account number, and any reference numbers. Request a "fraud recall" or "reversal." For domestic wire transfers, ask them to initiate their fraud recall process with the receiving bank.

2. Report to the FBI. File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. This is not just for statistical purposes. The IC3 has a Recovery Asset Team (RAT) that can, in some circumstances, work with the destination bank to freeze the funds. The IC3 complaint number is essential for law enforcement and bank interactions. This process is most effective for transfers over $50,000 and reported within 24 hours.

3. Notify the Recipient Bank. While your bank will do this, a direct call to the fraud department of the recipient bank can sometimes accelerate the process. Provide them with the transaction details and your IC3 complaint number. They will not share confidential information with you, but you can put them on notice that the funds arriving in their customer’s account are the proceeds of a crime.

4. Secure Your Email Environment. The fraudulent transfer was a symptom of a larger problem: a compromised email account. You must assume the attacker still has access and is monitoring your communications. They may see your recovery efforts and try to move the funds faster or launch another attack. Immediately take steps to secure the compromised account, which includes resetting passwords, revoking active sessions, and searching for malicious forwarding rules or altered permissions. If you use Microsoft 365, follow a specific recovery checklist.

How does the fund recovery process work?

The process, often called a "Kill Chain" in banking circles, relies on inter-bank agreements and law enforcement cooperation. When your bank initiates a fraud recall, it sends a formal request to the receiving bank to return the funds. The receiving bank, however, is not legally obligated to do so without a court order or similar legal process unless their own customer (the fraudster) authorizes it, which is unlikely.

This is where the FBI's IC3 report becomes crucial. The Recovery Asset Team can contact the receiving bank and provide the official law enforcement report. This often provides the bank with the necessary justification to place an immediate administrative freeze on the account in question, preventing the funds from being withdrawn or transferred out. If the funds are still in the account, they can be frozen.

From there, recovering the money typically requires a legal process, such as a seizure warrant obtained by law enforcement. The exact steps and timelines vary based on the jurisdiction, the banks involved, and the amount of money. It is not a fast process; even if the funds are successfully frozen, it can take months to get them returned.

When should I hire an outside incident response firm?

If the fraudulent transfer happened because of an email hack, you are dealing with more than just a single lost payment. You have an active security breach. Consider hiring an incident response firm like Lyra Recovery if:

• The funds are significant. The cost of a professional response is often a fraction of the amount lost.
• You are not a cybersecurity expert. Identifying and removing an attacker from a modern cloud environment like Microsoft 365 or Google Workspace is a complex, specialized skill. Missing a single backdoor could lead to a repeat incident.
• You need to understand the scope. You must determine what data the attacker accessed, such as employee PII, customer information, or trade secrets. This has significant legal, regulatory, and reputational implications that dictate whether you have to report a data breach.
• You need to preserve evidence. A proper forensic investigation preserves the evidence needed for law enforcement, insurance claims, and potential litigation. Mishandling the investigation can destroy crucial artifacts.
• You need to get operational again, safely. An incident response team can quickly and authoritatively declare an environment clean, allowing your team to trust their email and resume normal business operations.

An experienced team can manage the entire BEC incident response playbook, from containing the breach and eradicating the threat to supporting the fund recovery effort and restoring your systems.

Frequently Asked Questions

Can we just "pull back" or "cancel" a wire transfer?

Unfortunately, wire transfers are designed to be final and irrevocable. Once the funds are sent and the receiving bank accepts them, they legally belong to the recipient account holder. The recall process is a request, not a command. ACH transfers sometimes have a slightly longer window for reversal, but you should treat both with the same urgency.

What are the chances of getting the money back?

It depends almost entirely on how quickly you act. According to the FBI, their Recovery Asset Team has had a success rate of over 70% in freezing funds when notified within the first 24 hours. However, this only means the funds were frozen, not necessarily returned yet. The longer you wait, the lower the chances.

Our bank said they can't do anything. Is that true?

While their ability to unilaterally pull back funds is limited, they are a critical part of the process. They must initiate the formal recall request. If your frontline bank contact is unhelpful, immediately escalate to their fraud department or senior management. Providing an IC3 report number can often get their attention.

The attacker changed invoice banking details. What now?

This is a classic vendor email compromise scenario. In addition to the steps above, you must immediately notify the legitimate vendor (using a trusted phone number) that their invoices have been manipulated and their email account may be compromised. This can prevent other customers from falling victim and is a crucial part of the investigation. Learn more about what to do when someone hacked your email and changed an invoice.

Dealing with the fallout from a fraudulent wire transfer requires a calm, methodical, and extremely fast response. The financial loss is just one component of a serious security incident that demands a comprehensive investigation to ensure the threat is gone for good. If you are navigating this crisis, contact the Lyra Recovery team for immediate assistance with fund recovery and securing your environment from further attacks.