Wire fraud and BEC.

Wire fraud, in banking, is a fraudulent funds transfer: a wire sent on a deceived customer's instruction, or one sent in a customer's name without its authority. Business email compromise is the most familiar form.

Is wire fraud a federal crime?

Yes. The federal wire fraud statute covers any scheme to defraud carried out by interstate or foreign wire communications, not only bank wires. It carries up to 20 years in prison, or up to 30 years and a fine of up to $1 million when the fraud affects a financial institution.⁠[2]

Who is liable for wire fraud?

It depends on whether the customer authorized the wire and, if it didn't, whether the bank followed an agreed security procedure.⁠[3] Article 4A reaches Fedwire transfers through the Federal Reserve's Regulation J.⁠[4]

Business email compromise was the second-costliest fraud reported to the FBI in 2025, behind investment fraud.⁠[1]

• Up 10%: BEC losses reported to the FBI rose from $2.77 billion in 2024 to $3.05 billion in 2025.⁠[1]
• 86% of the payment methods BEC victims reported in 2025 were wire transfers or ACH.⁠[1]
• $568 million in BEC losses was reported by complainants 60 and older in 2025, some filing for a business, up from $385 million in 2024.⁠[1]

IC3 figures count losses that victims reported to the FBI, not all losses.

Most BEC wire fraud follows the same five steps.

1. 1Get inside the conversation. Compromise or spoof the email of someone who sends or approves payments, often after phishing or studying what the business makes public about itself.⁠[5]
2. 2Wait for a real payment. An invoice coming due, a closing date, a large purchase: the scheme works best when a payment is already expected.
3. 3Change the instructions. Send “updated” bank details from the real account or a look-alike address, often with urgency or a reason not to call.
4. 4Let the customer send it. The customer starts the wire through its normal channel and passes the bank's security procedure, because it really is the customer.
5. 5Move it on. The money lands in a mule account and is moved onward quickly: to other accounts, into crypto, or abroad.

In FinCEN's review of real estate BEC reports from 2020 and 2021, nearly 88% of incidents sent the first transfer to an account at a US bank or credit union; fewer than 8% went straight abroad.⁠[6] The receiving account often belongs to a money mule, witting or not, so the receiving bank's view matters as much as the sending bank's.

Which schemes are growing? In Federal Reserve Financial Services' 2026 risk officer survey, 38% of responding institutions said wire scams against account holders were increasing, 20% said BEC was and 14% said account takeover was.⁠[9]

Red flags

• An emailed request to change a payee's bank details, or new wiring instructions days before a real estate closing
• A first-time beneficiary, or a beneficiary bank or country new to the customer
• Urgency or secrecy: pressure to send today, or not to call and confirm
• A beneficiary name that doesn't fit the account, such as a company name on a personal account
• A new device, location, email address or phone number on the account shortly before a large wire
• An older customer sending an unexpected large wire, unsure of its purpose or guided by someone on the phone
• A large incoming wire to a new or quiet account, moved out within a day

Generally not, once the beneficiary's bank has accepted it. After acceptance, a cancellation needs that bank's agreement, and it works only if the order was unauthorized or, through a sender's mistake, a duplicate, sent to a beneficiary not entitled to the money, or for too much.⁠[3] Whether a wire induced by BEC fits those cases depends on the facts, so in practice recovery depends on freezing the money before it moves. Four other clocks run alongside.

Acceptance by the beneficiary's bankUsually on receipt of the wire

A beneficiary's bank accepts a payment order at the earliest of several events, including paying or notifying the beneficiary and receiving payment of the sender's order. A Fedwire pays the receiving bank when its account is credited or the order is sent, whichever is earlier, so acceptance generally arrives with the wire.

UCC §§ 4A-209(b), 4A-211(c) · 12 CFR 210.31(a)⁠[3]⁠[4]

The recovery windowWithin 72 hours of the transfer

No law sets this one; the odds do. FinCEN says its Rapid Response Program has had more success recovering fraudulently induced wires reported to law enforcement within 72 hours.

FIN-2022-FCT1⁠[10]

The SAR deadline30 calendar days from detection

A bank has 30 calendar days from first detecting facts that may support a SAR to file one, or up to 60 if no suspect has been identified. For email compromise involving fraudulent payment instructions, FinCEN says the obligation applies whether or not the scheme succeeded or anyone lost money, and a call to law enforcement doesn't replace it. More in SAR filing.

31 CFR 1020.320(a)(2), (b)(3) · FIN-2019-A005⁠[11]⁠[5]

Reporting an unauthorized wire90 days, at most from notice

A bank that must refund an unauthorized wire also pays interest — unless the customer failed to use ordinary care to spot the order and tell the bank within a reasonable time, no more than 90 days after the bank notified it that the order was accepted or its account debited. Then the customer loses the interest, not the refund.

UCC § 4A-204⁠[3]

The one-year barOne year from notice

A customer that received notice reasonably identifying a wire debited to its account must object within one year. After that, it can't claim the bank wasn't entitled to keep the payment.

UCC § 4A-505⁠[3]

A bank should act within hours of a fraudulent wire, on several fronts at once.

1. 1Call the beneficiary's bank. Ask for a recall and a freeze by phone and through the payment network, with any indemnity it asks for.
2. 2File with IC3. Report at ic3.gov with the full transaction details, whatever the amount, so the FBI's Recovery Asset Team may be able to help receiving banks freeze the funds.⁠[1] For a wire that went abroad, that complaint can also bring in FinCEN's Rapid Response Program.⁠[10]
3. 3Talk to the receiving bank under 314(b). If both institutions have a current notice on file with FinCEN, they can share what they know about the suspected fraud under the section 314(b) safe harbor, since fraud proceeds can involve money laundering.⁠[10]⁠[12]
4. 4Preserve the evidence. Keep the emails, login and device records and callback notes, and look for the same compromise in the customer's ACH, card and online-banking activity.
5. 5Decide on the SAR, with FinCEN's key terms. “BEC FRAUD”, “EAC FRAUD” or “BEC DATA THEFT” for email compromise, “EFE FIN-2022-A002” for elder exploitation, and “FIN-2024-DEEPFAKEFRAUD” where deepfakes were used.⁠[13] Add “RRP” and the case number if the program was used.⁠[10]

• $679 million of $1.16 billion in attempted theft was frozen through the IC3 Recovery Asset Team's Financial Fraud Kill Chain in 2025, across 3,900 incidents: a 58% success rate.⁠[1]
• 22% of the real estate BEC incidents reported to FinCEN in 2020 and 2021 ended in full recovery, 15% in partial recovery and 20% in none. Institutions blocked or declined another 12%; the rest gave no clear outcome.⁠[6]

The FBI counts funds frozen, which isn't the same as funds returned to the victim.

• Offer each customer a security procedure that fits it, and document the offer. Article 4A moves an unauthorized wire's loss to the customer only when the bank followed an agreed, commercially reasonable procedure.⁠[3]
• Call back on a number you already have. Verify new or changed instructions through a different channel from the one that delivered them, as FinCEN suggests — never a number in the email. Risk officers name mandatory callbacks among their fixes.⁠[5]⁠[9]
• Treat a new payee or changed bank details as a risk event. Wires are often irrevocable, so FinCEN stresses catching fraudulent instructions before payment.⁠[5]
• Watch the session, not just the wire. Account takeover shows in online banking first: a new device, a changed email or phone number, a password reset.

Why wire fraud reviews take so long

Deciding is quick once the picture is complete. Getting the picture is the slow part: the evidence for one outgoing wire sits in seven systems, and the customer is waiting for it to go. So review gets rationed — and a BEC wire, sent by the real customer through the real channel, passes every check that only asks who sent it.

Socratix AI coworkers can take on the gathering. For every wire, they can pull the evidence from each system, compare the payment with everything the customer has sent before, and hand your analysts a recommendation with the reasoning laid out. Your team still makes every call — it just stops spending the day assembling the picture.

Fraud has picked up new tools: businesses reported more than $30 million in 2025 losses to BEC scams involving AI.⁠[1] Your team can't add analysts that fast. AI coworkers can do the gathering — on every wire, around the clock — so the people you have spend their time on the decision. And FinCEN's 2026 proposed program rule says institutions that responsibly experiment with innovative technologies in their AML/CFT programs won't face added risk of a significant supervisory or enforcement action solely for using them.⁠[14]

1. GatherCan pull the wire, the customer's past beneficiaries and usual amounts, the online-banking session, callback records and prior alerts from the systems that hold them, into one case.
2. AssessCan check the wire against the customer's own history and the patterns of BEC, account takeover and elder exploitation, confirm the agreed security procedure was followed, and watch the clocks.
3. RecommendCan recommend releasing, calling back, holding and contacting the customer, or starting a recall — with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnCan learn from each decision — your policies, your risk appetite, your analysts' judgment — and log every step for the examiner.

Related guides

• ACH fraud Unauthorized debits, account takeover and BEC-driven credits, and the Nacha return windows.
• Check fraud Washed, counterfeit and forged checks, mail theft, and the deadlines that decide who takes the loss.
• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.
• SAR investigations From alert to case to decision: how a suspicious activity investigation runs.