We sent money to a fraudster's account - what do we do right now, in order?

When you file a qualifying fraudulent-wire complaint at ic3.gov fast enough, IC3's Recovery Asset Team can initiate the Financial Fraud Kill Chain - coordinating with the receiving bank to freeze funds before they're withdrawn or moved offshore. It works only within a tight window (generally measured in hours to a couple of days) and above certain thresholds, which is exactly why you file immediately rather than waiting to investigate internally.

Reported within 24 hours to cooperative domestic banks, recovery is genuinely possible - funds may still be sitting in the receiving account. After 72 hours, fraudsters have typically layered the money through mule accounts or moved it abroad, and recovery odds drop steeply. The clock, not the amount, is the primary determinant of getting money back.

Your bank first (they initiate the recall and contact the receiving bank), then IC3 (ic3.gov, request the Recovery Asset Team), then local police, then your insurer - but if you have multiple people, run these in parallel; minutes matter.

Call the fraud line, state it's fraud, and provide the date, amount, sending and receiving account/routing, trace or IMAD/OMAD reference, and a brief incident description; the bank sends a recall request - for ACH, fraud isn't a standard return reason, so it becomes a recall/dispute, which is why prevention beats remedy.

Named roles and a call tree, the bank fraud-line and IC3 details, step-by-step scripts for the first hour, evidence-preservation instructions (don't delete the email, capture headers), insurer notice requirements, and a post-incident control-review checklist.

It depends on the policy: computer-fraud coverage often excludes losses where an employee voluntarily transferred funds (as in BEC), while social-engineering fraud coverage is specifically designed for it - many BEC claims fail because the company carried only the former. Confirm you have social-engineering coverage and know its sublimit.

Recovery odds are low but not zero; still file with IC3 and police, notify your insurer within policy deadlines, request a recall, and - most importantly - complete a control remediation, because late discovery is itself a finding about your reconciliation cadence.

Do not delete or forward-and-delete the messages; export the full original emails including headers (which show true routing), preserve them in a separate location, document who had access, and hand them to investigators and your insurer intact.

Re-verify every recently changed vendor bank detail, confirm segregation of duties and dual control are intact, check for compromised credentials and reset them, validate callback procedures are being followed, and document the gaps the incident exposed and how they're closed.

Material losses generally require disclosure to auditors and, depending on size and circumstances, the board; insurers and possibly regulators have notice requirements too - set the materiality threshold with finance leadership and counsel rather than deciding ad hoc.

Incident recovery is a bank, law-enforcement, and insurer process - not a software function. Stampli's role is upstream: payment-integrity controls and validation guardrails that flag suspicious changes and block payments on unverified details aim to prevent the diversion, and the immutable audit trail provides the who-approved-what-and-when record investigators and insurers request after the fact.