BEC Wire Recall Triage
A payment went to the wrong account. Enter what you know and get an honest recall-likelihood band, the people to call, in order, and a mailbox triage checklist. If your bank does not know yet, call them first and come back.
The payment
Past the first day the money has often moved on. Recall and freezes of onward accounts are still worth pursuing.
A band from simple rules — time since payment, domestic or international, whether the bank is acting. Not a probability and not a guarantee.
Who to call, in order
- 1NowYour bank's fraud line (by phone)
Call now — use the number on the bank's website or your card, never one from an email. Ask them to recall the payment and to ask the receiving bank to freeze the funds. Have ready: amount, value date, beneficiary account, the bank's transaction reference. Get a case number and the analyst's name, then confirm in writing.
- 2The receiving bank — through your bank
You usually cannot deal with the receiving bank directly. Your bank sends the recall and freeze request. Ask how and when you will hear back.
- 3NowFBI Internet Crime Complaint Center (IC3) — ic3.gov
File a complaint today with the payment details. The FBI's Recovery Asset Team works from IC3 complaints with banks on domestic transfers, so speed matters. For a large loss, also contact your local FBI field office. Give the complaint reference to your bank.
- 4Accounts payable and treasury
Stop further payments to the same beneficiary details. Pull the vendor-master change log and check every payment to changed bank details in the last 90 days.
- 5The real supplier — on a number from your own records
Call the supplier using a number from the contract or an old invoice, not the email. Confirm the real bank details and tell them their mailbox may be compromised.
- 6Your insurer or broker
Notify in line with the policy's notice conditions. Social engineering or funds-transfer fraud cover often has its own conditions and sub-limits. Be accurate about what verification was done.
- 7Legal and privacy
A compromised mailbox usually holds personal data. Ask counsel whether notification duties apply; some run from when you became aware (for example 72 hours under GDPR).
- 8Mail and sign-in logs
Search for the same sender, lure or link sent to other staff and suppliers, and the same attacker IPs in sign-in logs.
- 9Executives and counsel
Brief the executive team today. Ask counsel whether the loss triggers any disclosure or reporting duties for your organisation.
Mailbox triage
Once the bank and the authorities have the case, lock down the mailbox. Tick as you go (kept on this page only).
What this tool does
- For the hours after a payment went to a fraudster's account: enter the amount, currency, hours since payment, domestic or international, whether your bank knows, whether you found mailbox rules and whether others were phished.
- Get an honest recall-likelihood band — from "Best window" to "Very low". Chances fall fast after 24 to 72 hours. It is never a guarantee.
- Get the call list in order: your bank's fraud line, the receiving bank through your bank, the right authority (IC3 in the US, Action Fraud in England, Wales and Northern Ireland, ReportCyber in Australia, the Canadian Anti-Fraud Centre), the supplier on a known number, and your insurer.
- A mailbox triage sub-checklist covers sessions, rules, forwarding, delegates, OAuth apps, sent and deleted items, audit logs and lookalike domains.
- Copy the whole plan as plain text. Nothing you enter leaves your browser, and no account numbers are needed.
Why the first hours matter
Payment-redirection fraud usually lands money in a mule account, which is emptied into onward transfers within a day or two. A recall works only while the money is still there, so the bank call comes before the investigation. Once the bank and the authorities have the case, contain the mailbox and work through the full BEC Response Checklist.
Frequently asked questions
Can a wire transfer to a fraudster be recalled?
Sometimes. Your bank sends a recall request to the receiving bank, which can return the money only if it is still in the account and its own rules allow. Fraudsters usually move funds on quickly, so the chances are best in the first hours and fall fast after 24 to 72 hours. Treat any recall as a chance, not a guarantee.
Who do I call first after paying a fake invoice?
Your bank's fraud line, by phone, using a number from the bank's website or your card. Ask for a recall and a freeze request to the receiving bank. Then report to the authorities — IC3 in the US, Action Fraud in England, Wales and Northern Ireland (Police Scotland on 101 in Scotland), ReportCyber in Australia, the Canadian Anti-Fraud Centre — and give the reference to your bank.
Can I contact the receiving bank myself?
Usually not effectively. The receiving bank deals with your bank, not with you, and will not discuss its customer's account. Your bank sends the recall and freeze request and passes back the answer.
Why does the tool ask about mailbox rules and other recipients?
Hidden inbox rules mean a mailbox is compromised, which changes the response: the mailbox must be contained, personal data may have been exposed, and the attacker may be targeting other people. If others received the same lure or fake instructions, warn them by phone or a separate channel.
Is this legal or financial advice?
No. It is practical guidance from simple, visible rules. Your bank, the authorities, your insurer and your counsel make the real decisions.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.