What to Do in the First 30 Minutes After Suspected Wire Fraud
Every Minute Costs Money. This Is Not a Figure of Speech.
The moment you realize a wire transfer may have gone to the wrong account, a clock starts running. Not metaphorically — literally. Fraudsters move stolen funds through multiple accounts within minutes to hours of receipt, deliberately putting them beyond the reach of standard banking recalls. The window to intercept them is narrow, and it closes fast.
The FBI's Recovery Asset Team initiated 3,900 incidents in 2025, freezing $679 million of $1.16 billion in attempted thefts — a 58% success rate. That number is meaningful — but it depends entirely on one variable: speed of reporting. Victims who act within the first hour have a dramatically better chance of recovery than those who wait hours or days while trying to figure out what happened. HousingWire
Unlike credit card charges or ACH transfers, wire transfers are immediate and generally irreversible. Once you authorize a wire, the funds are gone within minutes. Banks rarely succeed in recovering wired funds, especially if hours have passed. Prospectut
This post is a step-by-step guide to the first 30 minutes — what to do, in what order, with what information, and why each step matters. It is written for agents, transaction coordinators, buyers, and sellers. Keep it. Share it. Know it before you ever need it.
Before the Clock Starts: The Moment You Must Act
There is a specific moment this guide applies to: the moment you realize — or strongly suspect — that a wire transfer has gone to a fraudulent account. This might happen because:
You called the title company to confirm receipt of funds, and they have no record of receiving them
Your client tells you they wired money based on an email that, upon review, was not from a legitimate party
You discover that wire instructions you forwarded or referenced were fraudulent
A party to the transaction reports that funds have not arrived at the expected account
The moment that realization hits, stop everything else you are doing. Do not send emails. Do not try to investigate the fraud yourself. Do not wait to be certain. If you suspect it, act as if it is confirmed — because the cost of acting on a false alarm is a few phone calls. The cost of waiting is the money.
Minutes 0–5: Call Your Bank — Right Now
This is the first call. Not the title company. Not your agent. Not the FBI. The bank.
Upon realizing that a cybercrime involving a fraudulent wire has taken place, a victim should immediately contact the victim's bank and ask the bank to immediately issue a recall notice, and contact the recipient bank to ask for an immediate freeze on the recipient account. The Florida Bar
Call the sending bank — the institution from which the wire was initiated — and ask specifically for the fraud department. Do not go through general customer service if you can avoid it. Request two things immediately:
First: A wire recall. Ask the bank to formally request that the receiving institution return the funds due to fraud. Use the exact words "wire recall due to fraud." Have your wire confirmation details ready — the amount, the date and time of the wire, the recipient account number and routing number from the fraudulent instructions, and the reference number from the wire confirmation.
Second: A Hold Harmless Letter or Letter of Indemnity. Contact the originating financial institution as soon as fraud is recognized to request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity. This document protects the receiving bank if it freezes the funds pending the fraud investigation, and requesting it signals to the bank that this is a serious, documented fraud event — not a simple wire error. Department of Justice
Write down the name of every person you speak to, the time of the call, and exactly what was said. This documentation will matter for every subsequent step.
Minutes 5–10: Call the Receiving Bank
While your bank initiates the recall process, the receiving bank — the institution where the fraudulent account is held — needs to hear from you directly as well.
Call the receiving bank's fraud department to notify them that you have requested a recall of the wire because of fraud. Provide the details for the wire and request that the account be frozen. Old Republic Title
This step is important because a wire recall from the sending bank alone is not always sufficient to freeze the destination account. The receiving bank needs an independent notification so it can place a hold on the account before the fraudster withdraws or moves the funds.
You will need the receiving bank's name and, if possible, their direct fraud department contact. This information should be on the wire confirmation you received — the routing number will tell you which institution received the funds, and a quick search of that routing number will identify the bank. Call their main number and ask to be transferred to fraud or wire investigations immediately.
Again: document the call — name, time, what was requested, and any confirmation or reference number the bank provides.
Minutes 10–15: Call Back Your Sending Bank to Confirm
Call the sending bank back to confirm that the wire recall request was processed. Old Republic Title
This sounds redundant, but it is not. In a high-volume bank environment, especially if your first call went through general customer service before reaching the fraud department, the recall request may not have been formally logged or escalated. A follow-up call confirms that the request is in the system and moving through the appropriate channels.
Ask specifically: Has a formal recall notice been sent to the recipient bank? Has a case number been opened? Who is the assigned fraud investigator or case manager? Can you receive email confirmation of the recall request?
Get everything in writing. The paper trail you are building in these first 15 minutes is the foundation for every subsequent recovery effort and any insurance or legal claim that follows.
Minutes 15–20: File a Complaint With the FBI at IC3.gov
File a detailed complaint with IC3.gov. It is vital the complaint contain all required data. Go to IC3.gov — the FBI's Internet Crime Complaint Center — and file a complaint as completely as possible with the information you have at this moment. Department of Justice
The IC3 complaint triggers the FBI's Recovery Asset Team (RAT), which acts as a liaison between law enforcement and financial institutions to request emergency account freezes. Upon receiving an IC3 complaint filed about a fraudulent wire incident, the Recovery Asset Team immediately initiated the Financial Fraud Kill Chain to request a freeze of the fraudulent account at the recipient bank. In documented cases, this has resulted in full funds being held and recovered — but only when the complaint was filed quickly enough. National Association of Realtors
Include in your IC3 complaint:
Your name, contact information, and the type of fraud (real estate wire fraud / business email compromise)
The dollar amount wired
The date and time of the wire
The account number and routing number to which funds were sent
All email addresses involved in the suspicious communication
A brief description of how the fraud occurred
Do not wait until you have a complete picture to file. File with what you know right now, and you can supplement the complaint with additional details later. Speed of filing matters more than completeness at this stage.
Minutes 20–25: Notify the Title Company, Your Agent, and Your Attorney
By this point you have done everything within your immediate control to stop the funds. Now the network of transaction professionals needs to know.
Inform your escrow officer or settlement agent immediately upon discovering fraud. Call — do not email — using the verified phone number you established at the start of the transaction. Inform them of what happened: that a fraudulent wire was sent, that you have already called both banks and filed with IC3, and that you need them to secure the transaction file and notify any other parties who may be at risk. First American
This matters for two reasons. First, if the fraud involved a compromised email account anywhere in the transaction chain, the title company may need to immediately lock down their communications to prevent further exposure. Second, the title company may have their own fraud response protocols and contacts that can accelerate the recovery process.
If you are an agent whose client was victimized, contact your broker immediately as well. Implement your firm's emergency protocols and notify insurance carriers of potential exposure without delay, as some policies require prompt notice to preserve coverage. A call to your E&O carrier's claims line within the first few hours may be required to keep a future claim valid. Certifid
Minutes 25–30: Preserve Every Piece of Evidence — Do Not Delete Anything
This step does not feel urgent in the way that phone calls feel urgent. But it is critical, and it is one that victims frequently neglect in the chaos of the first hour.
IC3 instructs victims to retain all original documentation when reporting fraud. That begins with preserving evidence in its native format — saving full email files instead of screenshots, downloading attachments directly, retaining text messages with timestamps intact, and avoiding forwarding or editing files in ways that could strip metadata. This step is especially important in cases involving AI-generated content. Original files allow forensic experts to examine hidden data and detect manipulation. HousingWire
Specifically, in the next few minutes:
Save the fraudulent emails in their original format. In Gmail, use "Download message" to save as a .eml file. In Outlook, save as .msg. Screenshots of emails are not adequate for forensic investigation because they do not contain the email headers that reveal routing information, sender IP addresses, and other data investigators need.
Screenshot or save all text messages related to the suspicious communication, making sure timestamps are visible.
Do not delete, move, or forward any suspicious communications in a way that alters the original files. Do not attempt to "clean up" a compromised email account before investigators have had a chance to examine it.
Collect all related documents — wire instructions, settlement statements, title records, and confirmation receipts — and keep them organized and unaltered. When sharing information with investigators or financial institutions, provide copies rather than originals and document when and how the files were transmitted. HousingWire
After the First 30 Minutes: What Comes Next
The first 30 minutes address the immediate recovery window. After those steps are complete, the following actions should happen within the next several hours:
File a local police report. Call your local police department or sheriff's office and report the wire fraud. Ask for a case number. This document will be needed for insurance claims, civil litigation, and potentially for the FBI investigation.
Contact the FTC. Report the fraud at ReportFraud.ftc.gov. While the FTC does not directly recover funds, the complaint contributes to a national fraud database that helps law enforcement identify patterns and pursue organized fraud operations.
Contact your nearest FBI field office directly. Contact the nearest regional FBI field office in addition to filing the IC3 complaint. A direct call to the field office — particularly if the wire amount meets the Financial Fraud Kill Chain threshold — can accelerate the response. The Florida Bar
Understand the Financial Fraud Kill Chain (FFKC) threshold. The Financial Fraud Kill Chain can only be implemented if the fraudulent wire transfer is equal to or greater than $50,000, the wire transfer has occurred within the last 72 hours, and a SWIFT recall notice has been initiated if the transfer was international. If your loss meets these criteria, explicitly ask your bank and the FBI to initiate the FFKC process. If it does not meet the threshold, the fraud should still be reported — the FBI may be able to connect it to other investigations and pursue recovery through other means. Activeintel
Engage a professional fraud recovery service if funds are not immediately frozen. CertifID's Fraud Recovery Services have supported 773 victims and recovered over $118 million in stolen funds, with a 69% recovery rate that is well above the industry average. Specialized recovery services have established relationships with financial institutions and law enforcement that individual victims typically do not, and they can move faster and more effectively through the recovery process. Certifid
What Determines Whether Money Gets Recovered
Recovery is not random. It depends on a small number of variables — and the most important one is the one you control in the first 30 minutes.
Successful recovery depends on a number of factors, including how much time elapsed between when the fraud occurred and when it was discovered. Certifid
The second most important variable is whether the funds have already been moved out of the first fraudulent account. Once fraudulent instructions are followed, criminals quickly move funds through multiple accounts to prevent recovery. When the recall request reaches the receiving bank and the funds are still in the first account, recovery is possible. When funds have already been transferred to a second account — or converted to cryptocurrency — recovery becomes dramatically more difficult. Certifid
Smaller amounts are often the most painful: they typically don't get recovered because financial institutions don't slow them down, and for those buyers, it's often all of their savings. That down payment might represent years of effort. HousingWire
The third variable is the completeness of the paper trail. Investigators, banks, and recovery services need specific transaction details — the exact wire amount, the timestamp, the destination routing number and account, and the full content of the fraudulent communications — to initiate recovery procedures. The documentation discipline you practice in the first 30 minutes directly determines how effectively the next steps can proceed.
The Emotional Reality — and Why Process Matters More Than Panic
This guide describes a sequence of phone calls and documentation steps. What it does not fully capture is the emotional experience of realizing that a client's life savings — or your own — may have just been stolen. That realization is terrifying, and the panic it generates is exactly what makes this kind of response difficult.
This is why having the response protocol in place before it is needed is so important. When the brain is in panic mode, it cannot generate a calm, sequential action plan from scratch. It can follow one that already exists.
56% of consumers said they would not work with a title company or real estate firm again after a wire fraud incident — even if all of their funds were fully recovered. The reputational and relational consequences of fraud extend beyond the immediate financial loss. An agent who responds quickly, who knows exactly what to do, who guides a client through the recovery steps calmly and competently — that agent demonstrates a level of professionalism that the situation demands and that clients will not forget. Certifid
Having this protocol in place is not pessimism. It is the same logic that makes people buy fire extinguishers and know where to find them before the fire starts.
The 30-Minute Response Checklist
Print this. Save it. Share it with every client at the start of every transaction.
Minutes 0–5: Call the sending bank's fraud department. Request a wire recall and a Hold Harmless Letter or Letter of Indemnity. Document the call.
Minutes 5–10: Call the receiving bank's fraud department. Report the fraudulent wire and request the account be frozen. Document the call.
Minutes 10–15: Call the sending bank again to confirm the recall request was formally logged. Get a case number and the name of the assigned investigator.
Minutes 15–20: File a complaint at IC3.gov with all available details. This triggers the FBI's Recovery Asset Team.
Minutes 20–25: Notify the title company, your agent, your attorney, your broker, and your E&O insurance carrier. Use verified phone numbers, not email.
Minutes 25–30: Preserve all original evidence — emails in native format, text messages with timestamps, wire confirmations, and all related documents. Do not delete, forward, or alter anything.
Hours 1–24: File a local police report. Contact the FTC at ReportFraud.ftc.gov. Contact your nearest FBI field office directly. Engage a professional fraud recovery service if funds have not been frozen.
Work With a Transaction Coordinator Who Builds Prevention Into Every File
The best outcome of this post is that you never have to use it. Wire fraud is prevented at the front end — through verified contacts, secure portals, phone confirmation of all wire activity, and a professional who knows what a compromised file looks like before money moves.
At Signed to Keys, every transaction runs through a secure client portal with one dedicated point of contact, verified contacts established at file opening, and a firm policy that wire instructions are never acted upon based on email alone. We serve agents across Pennsylvania, New Jersey, New York, Maryland, Connecticut, and Delaware.
If you want a coordinator who treats fraud prevention as a core part of the job — not a footnote — let's talk.
Request Your Free Consultation → signedtokeys.com
No obligation. No long-term commitment. Just 30 minutes to talk about how we protect your transactions from the first signed contract to the day your client gets their keys.
Frequently Asked Questions
What is the most important thing to do in the first minute after suspected wire fraud?
Call your bank's fraud department and request a wire recall immediately. The longer funds sit in a fraudulent account without a recall request on record, the more time the fraudster has to move them beyond reach. Everything else — filing with the FBI, notifying the title company, preserving evidence — follows from this first call. Speed on this step determines whether recovery is possible at all.
What information do I need to have ready when I call the bank?
Have the wire confirmation document in front of you. You will need the exact dollar amount wired, the date and time of the transfer, your account number and the sending institution's details, the recipient's routing number and account number from the fraudulent instructions, and any reference or confirmation number from the wire. If you don't have all of this immediately, call anyway and tell them what you do have — the bank can pull the wire record on their end.
What is the Financial Fraud Kill Chain and does it apply to my situation?
The Financial Fraud Kill Chain (FFKC) is an FBI program that coordinates between law enforcement and financial institutions to freeze fraudulent accounts and intercept stolen funds. It applies when the fraudulent wire was $50,000 or more, occurred within the last 72 hours, and involved a domestic or international transfer meeting specific criteria. Ask your bank explicitly whether the FFKC can be initiated for your situation, and file your IC3 complaint as quickly as possible — the IC3 complaint is what triggers the FBI's Recovery Asset Team to begin the FFKC process.
Can wire fraud funds actually be recovered?
Sometimes — and speed of reporting is the primary factor. The FBI's Recovery Asset Team froze $679 million of $1.16 billion in attempted thefts in 2025, a 58% success rate. Specialized fraud recovery services report even higher rates in the cases they accept. Recovery is most likely when the fraudulent account still holds the funds and the recall request and IC3 complaint were filed within the first few hours. Once funds are moved to secondary accounts or converted to cryptocurrency, recovery becomes significantly harder.
Should I try to contact the fraudster or investigate the fraud myself?
No. Do not attempt to communicate with whoever sent the fraudulent email. Do not try to reverse-engineer where the money went on your own. Do not forward suspicious emails or engage with any contact information from the fraudulent communication. Your job in the first 30 minutes is to make the calls described in this guide, preserve evidence in its original form, and get the right professionals — your bank's fraud team, the FBI, and your title company — involved as quickly as possible.
What happens if I don't report it within 72 hours?
The Financial Fraud Kill Chain has a 72-hour window as one of its eligibility criteria. Reporting after that window may limit the specific tools available to the FBI's Recovery Asset Team. However, you should still file an IC3 complaint, a local police report, and contact the FTC regardless of timing — the FBI may be able to connect the case to other investigations, and documentation matters for insurance claims and civil recovery even if direct fund recovery is no longer possible.
Who else needs to be notified beyond the banks and the FBI?
Your title company or closing attorney, using a verified phone number — not email. Your real estate agent if you are a buyer or seller. Your broker if you are an agent. Your E&O insurance carrier, because many policies require prompt notification to preserve coverage. The FTC at ReportFraud.ftc.gov. And your local police department for a case number, which you will need for insurance and any civil claims.
Why does evidence preservation matter if the money is already gone?
Because evidence is the foundation of every recovery and accountability path that follows. The original email files — not screenshots — contain metadata including sender IP addresses, routing information, and timestamps that forensic investigators use to trace the fraud and identify perpetrators. Complete, unaltered documentation also supports insurance claims, civil litigation against any negligent party, and the FBI investigation. Deleting, forwarding, or altering suspicious communications — even with good intentions — can compromise the investigation and weaken a future legal or insurance case.
What if the amount is under $50,000 — is there still hope for recovery?
Report immediately anyway. While the Financial Fraud Kill Chain has a minimum threshold, the bank recall process and IC3 complaint apply to any amount. Smaller losses are genuinely harder to recover because financial institutions process high volumes of transactions and smaller fraudulent accounts are moved or depleted quickly. But recovery has occurred below the FFKC threshold when the recall request was made quickly enough to reach the receiving bank before the account was drained. Every minute still matters regardless of the dollar amount.
What is the agent's responsibility if a client experiences wire fraud?
This is both a professional and potentially a legal question. Agents who receive notification of a fraud event have an obligation to assist the client in taking immediate action — calling the banks, filing with IC3, contacting the title company — and to notify their broker and insurance carrier promptly. Whether an agent faces liability depends on the specific circumstances of how the fraud occurred and what protections were or were not in place. This underscores why building fraud prevention into every transaction from the outset — secure portals, verified contacts, phone confirmation of all wire activity — is the most important protection an agent can offer.