What do I do in the first hour after my business sends money to a fraudster in the United States?

What do I do, in order?

1. Call your bank on the number on your statement or its website, not a number from an email.Ask it to recall or reverse the payment. Ask for a hold harmless letter or letter of indemnity too: the FBI names both.
2. Stop any other payment to the same account that is still waiting to go.
3. File a complaint at ic3.gov.Put the banking details in the fields the form gives.
4. If the money went to an account outside the United States, say so in the complaint.FinCEN's program for money sent abroad starts when law enforcement refers a complaint. Do not call FinCEN yourself.
5. Keep every email, payment instruction and confirmation as they are.
6. Make no further change to payment details without calling the real recipient on a number you already had.

What do the FBI and FinCEN say about timing?

Neither source gives a one-hour window. Both say now.

Contact the originating Financial Institution as soon as fraud is recognized to request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity.

A victim should immediately contact their financial institution to report fraudulent activity and request assistance. Please do not contact FinCEN directly.

FinCEN is most likely to be able to interdict or recover funds when fraudulently induced wire transfers are reported to law enforcement within 72 hours of the transaction.

It is vital the complaint contain all required data in provided fields, including banking information.

Why is the bank the first call?

Under the Uniform Commercial Code, a cancellation works only if your bank hears in time to act on it. Each step after that needs another bank's agreement.

a communication by the sender cancelling or amending a payment order is effective to cancel or amend the order if notice of the communication is received at a time and in a manner affording the receiving bank a reasonable opportunity to act on the communication before the bank accepts the payment order.

What can an outside reading tell you after a payment fraud?

An outside reading cannot see your mailboxes, so it cannot tell you whether someone signed in to one.

It can show three things that bear on how a fraud like this reaches a firm: whether your DMARC record tells mail servers to refuse mail forged in your name, which look-alike domains of yours are registered, and which addresses at your domain are listed in breach data from other services.

Where do I go next?

• The FBI's Financial Fraud Kill Chain
• FinCEN's Rapid Response Program
• What to tell law enforcement
• Cancelling a wire: UCC 4A-211
• Regulation E and business wires
• What U.S. Bank says
• What PNC says
• What Regions says
• What Truist says