Wire Fraud After an Email Hack: How To Get the Money Back
September 16, 2026
Recovering a fraudulent wire is a race against the clock. Here is the sequence that actually recovers funds, and the window you have to run it.
The technical incident and the financial incident run on different clocks. Forensics can take a week. Money recovery is measured in hours.
Hour one: the bank
Call your bank's fraud line — do not email — and request a recall or reversal on the payment. Give the transfer reference, amount, timestamp, and receiving details. Ask them to contact the receiving institution to freeze the funds. Speed is the whole game: funds are typically dispersed through mule accounts within a day or two.
Hour one, in parallel: IC3
File with the FBI's Internet Crime Complaint Center at ic3.gov and state that it is business email compromise with a wire transfer. Filings that arrive quickly can be routed to the Financial Fraud Kill Chain, a mechanism that has frozen very large sums when notified fast. Include everything the bank gave you.
Also on day one
Notify your cyber insurance carrier or broker. Many policies distinguish between funds transfer fraud and social engineering fraud coverage, and prompt notice is usually a condition. Bring in counsel, and file a local police report if requested by the bank or your insurer.
Preserve the fraud thread
Do not delete the fraudulent messages. Export them with full headers, along with the sign-in and audit logs from the compromised mailbox and the inbox rule that hid the exchange. This is what supports both the claim and any law-enforcement action.
Contain the mailbox at the same time
The account that carried the fraud is still compromised until it is not. Run the first-hour containment sequence alongside the money work — different people on different tasks, one incident commander.
Then fix the process
Fraudulent wires succeed because a payment instruction changed over email and nobody verified it by voice. Mandatory callback verification to a known number, dual approval over a threshold, and a hard rule that bank details never change based on an email are worth more than any single tool.
Business email compromised right now? Call 1-844-LYRA-REC — our incident commanders answer live 24/7 and start containment on the first call. See our business email compromise response page for the first-hour checklist.