If a wire just left, do this in the next hour
Speed is the entire game with business email compromise (BEC).
The FBI's Financial Fraud Kill Chain (FFKC) can recover funds, but only when the receiving bank is contacted before the attacker pulls the money out.
Recovery odds drop from ~75% in the first 24 hours to single digits after 72 hours.
The 60-minute checklist
- Call your bank's wire fraud department. Not the branch. Not the customer service line. The fraud or AML team. Tell them you have an unauthorized wire and request a recall under "fraudulent payment order" / Article 4A reasoning.
- File at IC3.gov. The FBI's Internet Crime Complaint Center is the federal triage point. Note the exact wire amount, sending and receiving bank, account numbers, and timestamp. IC3 is what triggers the FFKC process.
- Email your bank in writing. Within the hour, follow up your phone call with an email so you have a paper trail of when you reported the fraud. Your insurance policy will require this.
- Lock down the compromised inbox. Sign out all sessions, rotate the password, audit and delete any forwarding rules or filters, revoke OAuth grants. See our forensic checklist for compromised email.
- Tell your insurance broker. Most cyber policies have a 24-72 hour notice requirement. Late notice can void coverage.
Day 1-2: forensic preservation
Before anyone "cleans up" the compromised mailbox, preserve it forensically.
The evidence you need:
- Sign-in logs from Microsoft 365 / Google Workspace covering at least the 30 days before the incident
- Mailbox audit logs showing what was opened, forwarded, modified, deleted
- Inbox rules and filters, exported and timestamped
- OAuth grants and consented apps in a full export
- The fraudulent emails themselves, with full headers and not just the body
- Wire instructions sent and received, every version, including the legitimate one and the swapped one
If your IT vendor has already "fixed it" by deleting suspicious rules and resetting passwords without preserving the artifacts, your insurance claim and any subsequent litigation just got harder.
We recover what is recoverable from wire fraud recovery engagements like this.
How BEC scams actually work, so you can prevent the next one
Three patterns explain ~90% of small-business BEC losses:
- Vendor email compromise. Attacker compromises one of your vendors, watches their email for invoices about to be sent, then sends a "we changed banks" email from the legitimate vendor address with new wire instructions. You pay the attacker. Defense: verbally verify any change in payment instructions using a phone number from your vendor file, not from the email.
- CEO impersonation. Attacker spoofs your CEO's email (or, harder to detect, registers a lookalike domain that swaps `m` for `rn`) and asks the bookkeeper to wire urgently. Defense: written approval workflow for wires above a threshold; never wire on email instruction alone.
- Inbox compromise of an executive. Attacker is reading the executive's email for weeks before striking, knows the deals in flight, and intercepts the right conversation at the right moment. Defense: MFA, conditional access, and audit-log monitoring catch this in days instead of weeks.
The insurance reality
- Standard cyber policies often exclude social-engineering wire fraud unless you have a specific endorsement (often called "Funds Transfer Fraud" or "Social Engineering Fraud"). Read your declarations page.
- Coverage limits on social-engineering fraud are usually a small sub-limit, often $50K- $250K, even when your overall cyber limit is $5M.
- Insurers will ask whether you had MFA, dual-control on wires, and email-spoofing protection. "No" answers can reduce or void coverage.
What we do
24/7 BEC and wire fraud recovery covers rapid containment, forensic preservation, recovery coordination with your bank and the FBI, and the written report your insurance carrier and counsel will need.
Available as a retainer engagement for SMB clients who want a number to call before they need it.
Related services
Self-serve forensic tool
Want professional help with responding to a BEC scam?
$995 once. Lifetime license
Run SleuthX yourself. Every tool unlocked, no subscription.
