Wire recall across every bank the money passed through: agents send the request for return in minutes and follow up with each bank, and a maker and a checker approve every send, hold, return and credit
Each request reaches the beneficiary bank in minutes, while there is money to freeze.
See one case, screen by screen ↓A wire recall is the sending bank's request that the beneficiary bank stop and return a payment, most often a wire sent to a fraudster after business email compromise. Wire & Instant Payment Recall runs that work for Fedwire, SWIFT, FedNow and RTP: agents match the customer's report to the payment, draft the request for return, follow up with every bank in the chain and follow money that moved on, while a maker and a checker approve every send, hold, return, credit and customer update.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
A wire recall is a race. When a business customer finds that a wire went to a fraudster, usually after an email changed a vendor's bank details, the money sits at the beneficiary bank for a few hours at most. Once that bank has accepted the payment, the sending bank cannot cancel it alone: under UCC § 4A-211 the beneficiary's bank must agree, and it may ask for an indemnity first. FedNow and RTP payments are irrevocable, so a return request that the receiving bank may decline is the only route back.
Today a payment recovery specialist reads the call note, finds the payment in the payments hub, copies the IMAD into a request for return, waits for a supervisor, then follows up with each bank in the chain by message, email and phone from a spreadsheet of fraud contacts. Nobody sees the whole chain at once, so a bank that has gone quiet is noticed late, and money that has moved on to a second bank is not followed. The same team answers the requests other banks send in, and instant payment return requests by the hundred, each with its own clock.
Estimated split of a specialist's minutes on one outbound wire recall, by hand and with the agents, from the customer's call to the credit. Our estimate, kept modest; the callback and every approval stay with people.
Eight agents match the report, send the request for return, chase every bank in the chain and follow the money; a specialist prepares, a supervisor approves.
Thursday, October 22, 2026, at Corvane National Bank. At 12:02 PM Ashgrove Mechanical Contractors, Inc. sent $186,000.00 by Fedwire to what it believed was its supplier, Delmont Industrial Supply. Here is the wire recall, screen by screen, in the working solution.
Dana Whitcomb, Ashgrove's controller, calls the treasury service line: the real Delmont has just asked to be paid. Lena logs the report and calls back on the number on file at 2:16 PM; without that callback, nothing is logged. The report lands on top of the recall desk with one button, Start the recall.
Ashgrove Mechanical Contractors, Inc. says a $186,000.00 wire sent at 12:02 PM went to a fraudster.
The Intake agent finds payment order WR-2026-1022-04418 in the payments hub, IMAD 20261022CRVNQ0A1004418, and checks it against two years of Ashgrove's payments. It is the first payment to this account: eleven earlier wires to Delmont went to Hollis Valley Bank, the account holder is "Delmont Supply Partners LLC", and the change came by email from a look-alike address. The Recall agent drafts a camt.056, reason FRAD, and opens fraud case FC-2026-08812.
Confidence 0.97 · threshold 0.85 · hands to Marisol Quintero, maker
Marisol, the payment recovery specialist, prepares the request at 2:19 PM. Desmond, the wire operations supervisor, approves it at 2:21 PM; he could not approve it if he had prepared it. Fedwire carries it at 2:22 PM, 8 minutes after the call.
The recall is drawn as a relay of stations: Corvane, Bayline Bankers' Bank as intermediary, and Lakemoor Savings Bank as beneficiary bank. Bayline acknowledges at 2:23 PM and forwards at 2:25 PM, so the request for return is at Lakemoor 11 minutes after the call. Each station shows the request sent, the acknowledgment, the answer and the minutes since the report.
Lakemoor has not answered in 15 minutes, so the Follow-up agent sends a second message and emails Lakemoor's fraud mailbox. At 2:44 PM it asks Marisol to call, with a script, because Lakemoor answers fastest by phone. She calls the fraud desk at 2:48 PM, and Lakemoor acknowledges at 2:51 PM.
Lakemoor Savings Bank: acknowledges 26 min, answers 49 min, funds frozen 64% of recalls.
Lakemoor answers with a camt.029: $142,000.00 frozen, 51 minutes after the report. $38,500.00 left by wire to Carrow Point Bank at 1:31 PM and $5,500.00 in cash at 1:52 PM. At 3:06 PM the Trace agent adds Carrow Point Bank to the relay as an onward station. Click the frozen amount and Lakemoor's answer opens with the passage highlighted.
Return of the frozen funds on receipt of a signed indemnity from the sending bank.
The Recall agent drafts the return instructions and indemnity IND-3 v3.2, with a request that Lakemoor recall its 1:31 PM wire of $38,500 to Carrow Point Bank. Marisol prepares at 3:08 PM, Desmond approves at 3:10 PM, and because the amount is above $100,000, Joan Whitlock signs the indemnity at 3:11 PM. The instructions go to Lakemoor at 3:12 PM.
The Customer update agent drafts what is frozen, what left, what happens next and what to do today. The draft is checked for message codes, any promise of recovery and anything about another customer or a restricted review. Lena prepares it at 3:12 PM, and Desmond approves it before it goes by secure message.
Dana, here is where your $186,000.00 payment stands. We reached the receiving bank 11 minutes after your call. At 3:05 PM it froze $142,000.00.
Lakemoor returns $142,000.00 by Fedwire, two hours and 32 minutes after Dana's call. The Ledger agent matches it to the recall, posts it from Fedwire settlement, GL 1010-100, to wire recall suspense, GL 2190-415, and proposes the credit to Ashgrove's account ending 2208. The credit needs a maker and a checker, and the $44,000 that did not come back stays on screen.
Brennick Community Bank asks Corvane to return $64,250.00 credited at 11:18 AM to Halverson Trading LLC, received 1:47 PM, with a hold decision due at 3:47 PM. The Freeze agent finds $61,980.00 still available, notes the account opened September 29 with four credits from four banks, each moved out within 48 hours, proposes a hold of $61,980.00 and drafts the answer. A maker and a checker decide, and the account goes to fraud case FC-2026-08807.
Confidence 0.93 · threshold 0.85
The same recall, seen by the people who prepare it, approve it, sign for it, tell the customer and take the fraud case: what their day looked like, and what it looks like now.
Eight agents match the report, send the request for return, chase every bank in the chain and follow the money; a specialist prepares, a supervisor approves.
Matches a customer's report to the payment order and compares it with 24 months of the customer's payments.
Drafts the camt.056 request for return on the right rail, Fedwire, SWIFT or instant payments, and drafts return instructions and indemnities.
Keeps a clock on every bank in the chain: a second message and the fraud mailbox at 15 minutes, a call script at 30, the supervisor at 60, the after-hours line outside the bank's hours. It records each bank's real response times.
Adds the next bank to the relay when an answer says money has moved on, drafts the onward request and prepares the law enforcement referral pack.
For requests other banks send Corvane, reads the request, the live balance and the account's history, proposes a hold of the lesser of the amount and the balance, drafts the camt.029 and flags money mule signs.
Drafts a plain-language update at each change: what is frozen, what left, what happens next and what to do today.
Matches each return to its recall and proposes the general ledger entries and the customer credit.
Builds export packs for examiners, internal audit, the BSA officer and law enforcement from the audit trail.
Approves every send, hold, return and credit a specialist prepared. The agents propose; a named person decides.
The assistant and the Ask the agents box answer from the recall's own messages, call notes and the bank directory, cite them, and open the right screen.
Why call Lakemoor's fraud desk instead of waiting?
Because Lakemoor answers fastest by phone: its median answer this year is 49 minutes, and messages alone have waited hours. The Follow-up agent wrote again at 15 minutes and asked Marisol to call at 30.
Can Corvane cancel this wire without Lakemoor agreeing?
No. Once the beneficiary's bank accepted the payment, cancellation needs its agreement, and it may ask for an indemnity (UCC § 4A-211). Fedwire applies Article 4A through Regulation J. That is why the return instructions carry Joan Whitlock's indemnity.
Can we ask Carrow Point Bank directly?
Not directly: Corvane has no wire relationship with Carrow Point Bank, and the $38,500 was Lakemoor's own customer's payment. The fastest route is Lakemoor recalling its 1:31 PM wire, which is in the return instructions. The Trace agent has also prepared the law enforcement referral.
Which requests asked of us can we freeze now?
Two fraud requests have money still in the account: Brennick's $64,250.00 to Halverson Trading, with $61,980.00 available, and Quellmont's $12,400.00, with $310.00 left. Both holds are proposed; each needs a maker and a checker.
13 screens from the working solution, on its sample data. Pick one to see it large.
Clocks, approvals, thresholds and records are settings. The administrator proposes a change, the SVP, Payment Operations approves it, and every change is on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Silence from a bank in the chain | Second message at 15 min · call at 30 min · supervisor at 60 min | After hours (6:00 PM–7:00 AM ET, weekends): the bank's after-hours line and the on-call supervisor |
| Fraud request asked of us | Hold decision within 2 hours | Any request asked of us answered within 1 business day |
| Instant return requests | Answer within 1 business day | Specialist prepares, supervisor approves the batch |
| Indemnity we give | Supervisor approves · authorized signer above $100,000 | Nobody signs an indemnity they prepared or approved |
| Agent confidence threshold | 0.85 for most agents; 0.90 customer updates; 0.95 ledger | Below it, the agent asks a person; new versions run against 240 past recalls first |
| Override of an agent | Reason code and note required | Every override counted in Reports |
| International wire of $50,000 or more | Law enforcement referral pack within 72 hours of the payment | Prepared by the Trace agent; sent by people |
| Retention and masking | Five years from closing; account numbers masked to the last four | Masking cannot be switched off in exports (31 CFR 1010.430) |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
Sources: FBI Internet Crime Complaint Center, 2024 Internet Crime Report (business email compromise: 21,442 complaints and $2,770,151,146 in reported losses; Financial Fraud Kill Chain: 3,020 complaints, $848.4 million in attempted theft, $561.6 million frozen, a 66% success rate) · Fedwire Funds Service ISO 20022 format FAQ, frbservices.org (camt.056 and camt.029 since July 14, 2025) · FedNow Service Operating Procedures (return request and payment return) · UCC Article 4A, § 4A-211 (uniformlaws.org) · Regulation J, 12 CFR part 210 · 31 CFR 1010.430 (records kept five years) · 31 CFR 1020.320(e) (SAR confidentiality). "demo" = seen in the working solution, on its sample data · "typical" = published figures · "estimated" = our estimate, kept modest. Corvane National Bank, Bayline Bankers' Bank, Lakemoor Savings Bank, Carrow Point Bank, Hollis Valley Bank, Brennick Community Bank, Quellmont Bank & Trust, Ashgrove Mechanical Contractors, Halverson Trading and the people, accounts, routing numbers and payment references named on this page are fictional: characters and sample data in the working solution.
A wire recall is the sending bank's request that the beneficiary bank stop and return a payment, most often a wire sent to a fraudster after business email compromise. Wire & Instant Payment Recall runs that work for Fedwire, SWIFT, FedNow and RTP: agents match the customer's report to the payment, draft the request for return, follow up with every bank in the chain and follow money that moved on, while a maker and a checker approve every send, hold, return, credit and customer update.
A client service officer logs the report and calls the customer back on the number on file. The Intake agent finds the payment, the Recall agent drafts the camt.056, a specialist prepares it and a supervisor approves it. The relay then shows each bank with its clock; the Follow-up agent writes again at 15 minutes and asks for a call at 30. When the beneficiary bank freezes funds, return instructions go out with a signed indemnity, and the Ledger agent proposes the customer credit when the money comes back.
Speed decides it, because the money rarely stays at the beneficiary bank for more than a few hours. In the working solution's sample recall, the request was at the beneficiary bank 11 minutes after the customer's call and $142,000 of $186,000 was frozen 51 minutes after it; the money came back 2 hours and 32 minutes after the call. These are demonstration figures on sample data, not a promise for any recall.
Not by the sending bank alone. Under UCC § 4A-211, once the beneficiary's bank has accepted a payment order, cancellation takes effect only if that bank agrees or a funds-transfer system rule allows it, and it may ask for an indemnity first. FedNow and RTP payments are irrevocable, so a return request that the receiving bank may decline is the only route back. That is why the solution sends the request within minutes and carries an indemnity on the return instructions.
camt.056 is the ISO 20022 message a bank sends to request the return of a payment; the receiving bank answers with a camt.029. Fedwire has used them since moving to ISO 20022 on July 14, 2025, and FedNow uses a camt.056 return request with a pacs.004 payment return. The Recall agent drafts the request on the right rail, Fedwire, SWIFT or instant payments, with the reason code, and nothing is sent until a maker and a checker approve.
Yes. Requests where Corvane holds the funds appear in their own row with their own clock: a hold decision within 2 hours for a fraud request and an answer within 1 business day for any request. The Freeze agent reads the request, the live balance and the account's history, proposes the hold and drafts the camt.029, and hands the account to fraud case management. Instant return requests are proposed one by one and approved as a batch.
Yes. The agents draft, follow up and propose; they never send, hold, return, credit or notify on their own, and never contact a customer or law enforcement. A specialist prepares and a different supervisor approves each step, an authorized signer signs indemnities above $100,000, and every override carries a reason code. A restricted review never appears on anything a customer could see.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your recall procedures, approval limits and a sample of past recalls and return requests, and it goes live once every quality gate has passed. We will walk you through it on your own recalls first.
False claims denied on the evidence, and no genuine victim denied.
1-min demoReg E Dispute ManagementEvery claim on its legal clock, provisional credit by day 3, every letter checked.
1-min demoP2P Fraud ClaimsEach payment placed on its side of the line, with the record that puts it there.
1-min demoWe'll run Wire & Instant Payment Recall on a sample of your own past wire recalls and return requests.