The Money Is Already Gone. Now You Have Hours.
What happens after a fraudulent payment leaves your account, and why the first calls decide whether you see it again
Executive Summary
Almost every article about payment fraud stops at prevention. Verify before you pay, and you should. This one starts a minute later, when the money has already left. Most owners assume the bank will pull it back. Business accounts do not work that way. There is no chargeback on a wire, no provisional credit while the bank investigates, and no regulation capping what a company can lose. What exists instead is a recovery window measured in hours and a sequence of calls that most businesses make in the wrong order. Here is that sequence, and the page worth writing before you need it.
A Wire Does Not Bounce
A bad check comes back to you. A fraudulent card charge gets reversed. People carry that expectation into wire and ACH payments, and it does not hold.
Your payment lands in an account opened for exactly this purpose. Within hours the balance is split across other banks, withdrawn, or converted into cryptocurrency, and after that nothing is sitting still for anyone to freeze. FinCEN has reported that funds are most likely to be interdicted when the transfer reaches law enforcement within 72 hours, with better results inside 24. In practice, your window is the rest of the business day.
Your Business Account Is Not Your Personal Account
Consumer accounts are covered by federal rules that cap personal liability and require the bank to credit disputed amounts while it investigates. Commercial wire transfers are not. They fall under Article 4A of the Uniform Commercial Code, an older and far less forgiving framework.
Under it, if your bank agreed a security procedure with you, that procedure was commercially reasonable, and the bank followed it in good faith, the loss generally stays with the business. These payments are also authorized in the technical sense, because your own employee sent them after being deceived, which is a weaker position than a transfer nobody at your company touched. We are not attorneys and this is not legal advice, but every owner should know which body of law their money sits under.
The First Calls, in Order
Order matters, because each call buys time for the next.
- Your bank's fraud or wire desk, not the branch. Request a recall or reversal and ask them to contact the receiving bank to freeze the account. Get the wire reference number, receiving bank details, and every correspondent bank on the transaction. Ask about a Hold Harmless Letter or Letter of Indemnity.
- IC3.gov, the same day. File a complaint with complete banking details, whatever the amount. Missing account information is the most common reason a report cannot be acted on quickly.
- Your insurance broker or carrier. Policies carry notice deadlines, and some require approval before you spend on response or legal help.
- Lock the intruder out, from a device you trust. These incidents usually begin in a compromised mailbox, and the attacker is often reading your email while you organize the response. Reset credentials, re-enroll multifactor authentication, and look for mailbox rules and forwarding that were quietly added.
- The real vendor or client, on a number you already had. They are often in the same campaign, sending their own payments to the same criminal.
The Federal Process, and Its Limits
The FBI's Internet Crime Complaint Center runs a Recovery Asset Team that works with banks through a process called the Financial Fraud Kill Chain. In 2025 it acted on 3,900 incidents and froze roughly 679 million dollars of about 1.16 billion attempted, a 58 percent success rate.
That describes cases that reached the process in time, not the odds for every business that gets defrauded. Eligibility has depended on a dollar threshold and a reporting window measured in days, criteria the FBI sets and can change, and smaller losses should still be reported. A freeze is also not a refund, because frozen money still works its way back through bank review. And nothing starts until someone at your company picks up the phone.
The Page to Write Before You Need It
One page, not a project. Keep it reachable without email, because email is often the thing that is compromised.
- The after hours fraud number for your bank, and your relationship contact.
- Who is authorized to request a recall, and what the bank requires before it will accept one.
- Where wire confirmations and payment records live, and who can reach them at six in the evening.
- Who notifies the insurer, and how quickly the policy requires it.
- Who calls the client or vendor, and what they are authorized to say.
The Takeaway
Prevention is still the cheapest control you will ever buy, and confirming payment changes through a second channel stops most of this before it starts. But every business eventually has a morning when a payment goes somewhere it should not have gone.
The companies that get their money back are rarely the most sophisticated. They are the ones where somebody knew, without looking it up, who to call first and what to ask for. That is a decision you make on a quiet afternoon, not at 4:45 on a Friday.
How Simulint Helps with BlueSphere
These incidents begin with a compromised mailbox and end with a payment nobody questioned. The BlueSphere phishing service, delivered through our partnership with Jericho Security, runs realistic practice attacks across email, phone, and text, so the people who move money have already turned down a convincing request before a real one arrives. BlueSphere Shield adds around the clock monitoring, which shortens the gap between an account being taken over and someone noticing. That gap is exactly what the criminal is spending.
BlueSphere Shield Velocity adds vCISO advisory, including building and rehearsing the response above, so the calls happen in the right order on the day it stops being practice.
Learn more about BlueSphere: https://lnkd.in/eE9HTaw8
