By The Falcon Consulting Group
A vendor emails to say their bank details have changed. The email comes from the right address, references a real invoice, and arrives right when the payment is due. Accounts payable updates the record and sends the wire.
Two weeks later, the real vendor calls asking why they have not been paid.
That is business email compromise, and it does not require a careless employee. It requires an attacker who has spent weeks reading the company’s email, or the vendor’s, and knows exactly when to step in.
This post covers what to do in the first hours after a fraudulent wire is discovered, and the controls that stop the next one. If the fraud turns out to involve an insider, our post on whether you can recover money stolen by an employee covers the recovery routes.
How Big Is the Problem?
Business email compromise is one of the costliest crimes reported to the FBI. According to a summary of the FBI’s 2025 Internet Crime Report, BEC accounted for more than $3 billion in reported losses in 2025 across 24,768 complaints, second only to investment fraud. Total reported cyber-enabled crime losses reached nearly $21 billion.
Those are reported losses only. Many companies never file, either because they do not know they should or because they would rather not have the incident on record.
The schemes vary, but most fall into a few patterns, which the FBI describes on its business email compromise page:
- Vendor impersonation. An attacker poses as a supplier and changes payment instructions.
- Executive impersonation. An email that appears to come from the CEO or CFO asks finance to send an urgent, confidential wire.
- Compromised internal accounts. The attacker takes over an employee’s real mailbox and uses it to request payments or redirect invoices.
- Real estate and closing fraud. Wiring instructions for a closing are intercepted and replaced.
What Should You Do in the First Hour?
Call the bank. Not email, not the online portal. Call the fraud department of the bank that sent the wire, tell them the wire was fraudulent, and ask them to request a recall from the receiving bank. For international wires, ask them to send a SWIFT recall message.
The receiving bank can freeze funds that are still in the account. Once the money has been moved onward, often within hours, recovery gets much harder.
Have the following ready when you call:
- The date, amount, and reference number of the wire
- The receiving bank, account number, and routing or SWIFT number
- The account holder name the wire was sent to
- A short description of how the fraud happened
What Is the FBI’s Financial Fraud Kill Chain?
It is a process the FBI uses with banks to try to freeze fraudulent international wires before the money disappears. According to published guidance on the Financial Fraud Kill Chain, it has generally applied when:
- The wire is $50,000 or more
- The wire is international
- A SWIFT recall has been initiated
- The wire occurred within the last 72 hours
To start the process, file a complaint with the FBI’s Internet Crime Complaint Center (IC3) immediately, with the full transaction details, and contact your local FBI field office. Criteria and procedures change over time, so confirm them with the FBI when you report.
Even if the wire does not meet the criteria, file the IC3 complaint anyway. Domestic wires are often frozen through the banks directly, and the FBI connects complaints across cases. Your report may be the one that links an account to a larger scheme.
The First 24 Hours: Preserve and Investigate
Do not delete the emails
The fraudulent messages are evidence. Their headers show where they actually came from, and they are what investigators and insurers will need. Forward them to no one outside the investigation team. Export them in native format with full headers.
Check for mailbox rules
Attackers who compromise a mailbox often set up rules that forward copies of incoming email to an outside address, or that move replies from the real vendor into a hidden folder. Check every finance mailbox for rules nobody created. This is often how the attacker knew exactly when to strike.
Reset credentials and turn on multi-factor authentication
If an internal mailbox was compromised, reset the password, end all active sessions, and require multi-factor authentication. If the vendor’s mailbox was compromised, tell the vendor through a phone number you already have.
Notify the insurer
Many crime and cyber policies cover social engineering fraud, sometimes with sublimits and specific notice requirements. Read the policy and send notice promptly.
Check for data exposure
If the attacker had access to a mailbox, they may have seen customer or employee personal information. State breach notification laws, including New Jersey’s, can require notice to affected individuals and sometimes to the state. Counsel should make that assessment early.
Can the Money Be Recovered?
Sometimes, and speed is the biggest factor. Funds frozen at the receiving bank can often be returned. Funds that have been moved through several accounts, converted to cryptocurrency, or sent overseas are much harder to reach.
Where the bank recall fails, recovery may still be possible through civil action against the receiving account holders, which often requires tracing the money across institutions. That is forensic accounting work: following the funds through bank records, identifying where they landed, and building the record a court needs to issue a freeze or judgment.
There is also the question of who bears the loss. Disputes between a company and its vendor, or between a company and its bank, over who should have caught the fraud are common. The answer depends on the facts, the contracts, and the controls each side had in place, which is another reason to preserve everything.
How Do You Stop the Next One?
Every BEC prevention program comes down to one rule: never act on payment instructions received by email without verifying them some other way. The Treasury Department’s Financial Crimes Enforcement Network makes the same point in its advisory on email compromise fraud, which lists the red flags banks and businesses should watch for.
The controls that matter most:
- Callback verification. Any change to vendor bank details is confirmed by calling the vendor at a phone number already on file, not the number in the email.
- Dual approval. Wires above a set threshold require two people to approve.
- A cooling period for new details. New or changed payment instructions do not take effect for a few days, which gives the real vendor time to notice.
- Multi-factor authentication on every email account, especially finance and executive mailboxes.
- Training with real examples. Finance staff who have seen what a real BEC email looks like are far more likely to pause.
- A no-penalty pause. Employees should know they will never be criticized for delaying an urgent payment to verify it, even if the request appears to come from the CEO.
Frequently Asked Questions
What is business email compromise?
It is a fraud in which an attacker impersonates or takes over a trusted email account, usually a vendor or executive, to trick a company into sending money or changing payment details.
What should I do first if we sent a fraudulent wire?
Call your bank’s fraud department immediately and ask them to recall the wire. Then file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.
How quickly do I need to report a fraudulent wire?
As quickly as possible. The FBI’s Financial Fraud Kill Chain has generally applied to international wires of $50,000 or more reported within 72 hours, and banks have a better chance of freezing funds the sooner they are told.
Can a fraudulent wire be reversed?
A completed wire cannot simply be reversed, but the receiving bank can freeze and return funds that are still in the account. That is why speed matters so much.
Does insurance cover business email compromise?
Some crime and cyber policies cover social engineering fraud, often with sublimits and conditions such as verification procedures. Read your policy before you need it, and give notice promptly if a loss occurs.
How do we know if our email was hacked?
Look for mailbox forwarding rules nobody created, sign-ins from unfamiliar locations, and sent messages employees do not recognize. A forensic review of the mailbox logs can confirm how and when access occurred.
The Bottom Line
Business email compromise succeeds because it looks like ordinary business. The attacker does not need to break anything. They just need someone to trust an email.
If it happens, call the bank, file with IC3, and preserve the evidence, in that order. Then fix the process so the next email gets a phone call instead of a wire.
Key Takeaways
- Call the bank’s fraud department the moment a fraudulent wire is discovered and request a recall.
- File an IC3 complaint right away, with full transaction details.
- Keep the fraudulent emails and check finance mailboxes for hidden forwarding rules.
- Notify your insurer and assess whether any personal information was exposed.
- Require callback verification on any change to payment instructions, using a number already on file.
- If the funds have moved, forensic tracing may still support recovery through the courts.
Work With Falcon Consulting Group
Falcon Consulting Group helps companies respond to payment fraud, from the first hours through recovery. Our former federal agents and CPA and CFE certified forensic accountants trace funds across institutions, work with counsel and law enforcement, and help companies close the gaps that let the fraud happen.
Learn more about our forensic accounting and fraud investigation services.
If your company just sent a wire it should not have, call your bank first. Then contact us.
About Falcon Consulting Group
Falcon Consulting Group is a corporate investigations and compliance advisory firm whose associates include former federal and state law enforcement personnel, former Inspector General staff, CPAs, Certified Fraud Examiners, and CAMS certified professionals. The firm supports counsel and corporate clients across forensic accounting, white collar investigations, litigation support, and regulatory compliance. Learn more about the Falcon team.