How the wire recall process works at major banks is not something we found described in any public source, and this page does not claim to describe any one bank's playbook. What every bank shares is the same rails and the same law. On Fedwire a recall is a request for return sent as an ISO 20022 camt.056 message and answered with a camt.029; on the FedNow Service it is a camt.056 return request that the receiving bank is asked to answer by midnight Eastern on the next business day; and on every rail the bank holding the money decides whether to give it back. What separates a desk that sends its request in minutes from one that takes hours is mostly what it has ready before the call comes in: a contact sheet that is current, a message map for each rail, approval and signing limits that someone can exercise tonight, and the facts law enforcement will ask for.
This page sets out those inputs as a buyer or project lead would need them, and is plain about which ones software can keep and which stay with the bank. The product shown is Wire & Instant Payment Recall, Botminds' software for recalling fraudulent wires and instant payments and answering the requests other banks send; its screens show a fictional bank and fictional counterparties on sample data.
What a wire recall desk brings on day one: six inputs, where each comes from, who keeps it
| Input | What it holds | Where it comes from | Who keeps it current |
|---|---|---|---|
| Counterparty fraud contacts | What it holdsFraud desk, fraud mailbox, after-hours line, best channel, who to escalate to and when, for every bank you recall from. | Where it comes fromPast recalls, correspondents, bilateral contact exchanges; for FedNow, the authorized persons each participant must name. | Who keeps it currentRecall desk; a supervisor confirms each change |
| A message map for each rail | What it holdsWhich message requests a return, which answers, which returns the money, and the reference that ties them to the payment. | Where it comes fromFederal Reserve Financial Services guidance for Fedwire and FedNow; your correspondents for SWIFT. | Who keeps it currentWire room and payments operations |
| Read access to the payment and the account | What it holdsPayment orders and IMADs, gateway messages, balances, holds and account history, case notes. | Where it comes fromPayments hub, Fedwire, SWIFT and instant gateways, core banking, case management. | Who keeps it currentPayments technology |
| Approval and signing limits | What it holdsWho prepares, who approves, who signs an indemnity and above what amount; the indemnity templates themselves. | Where it comes fromYour delegations of authority and legal’s templates. | Who keeps it currentHead of payment operations, legal |
| Clocks | What it holdsWhen to write again, call and escalate on silence; how fast to decide on a request another bank sends you. | Where it comes fromYour procedures; for instant payments, the FedNow response guidelines. | Who keeps it currentHead of payment operations |
| The law enforcement referral | What it holdsThe facts FinCEN lists as required for a Rapid Response referral, collected while the recall runs. | Where it comes fromThe payment, the customer’s report and the other banks’ answers. | Who keeps it currentFraud investigations |
How do major banks handle wire recalls?
Through the same steps as any bank, at a volume that forces them to be written down. The customer's report is verified by a callback, the payment is found by its reference, a request for return goes out on the rail the payment used, a fraud desk at the other bank is chased until it answers, an indemnity is signed if that bank agrees to return funds, and the money is posted and credited when it arrives. A bank that sends and receives many recalls has more reason to give them a desk of its own, apart from the wire room, with its own contacts and response times; a community bank may rely on a correspondent or bankers' bank for the Fedwire leg, as the sample's beneficiary bank does. Neither publishes its numbers, and we found no government or research source that measures how banks of different sizes perform.
The more useful question for a project lead is what any desk needs to run the process well, whatever its size. The six inputs above are that list. Each can be kept in a spreadsheet and an email folder, and many desks start that way; the cost shows up in the minutes it takes to find a number at 5:30 PM, and in requests that sit unread because nobody saw a bank go quiet. The first hour of a recall, seat by seat, is set out in the wire recall process in the first hour.
The contact sheet: fraud desks, after-hours lines and named FedNow contacts
A recall desk's most valuable asset is a list of people at other banks who can freeze an account, with the hours they answer. A generic customer service number, or a wire room that cannot decide on a freeze, costs exactly the minutes the recall is racing. The list needs more than numbers: which channel each bank answers fastest, whether it has an after-hours fraud line at all, how long it usually takes to acknowledge and to answer, and when to ask for its BSA officer.
For instant payments, part of the list is required by rule. The Federal Reserve Banks' Operating Circular 8 says "Each FedNow Participant is required to identify one or more authorized persons to receive reports of Reportable Transfers and to field inquiries related to Reportable Transfers", and allows the Reserve Banks to make that contact information available to other financial institutions. For wires there is no equivalent directory, and when the Federal Reserve announced longer Fedwire hours, commenters asked for one; the Federal Reserve said only that it "intends to consider developing a participant directory", and the directory commenters asked for would show which participants are active in the longer hours, not their fraud contacts.
Every bank’s fraud desk and after-hours line, with how fast it really answers
A contact spreadsheet against a bank directory kept by the recalls themselves
Spreadsheet of fraud contacts: Updated when someone notices a number has stopped working.
Directory kept by every recall: Each recall records who answered, on which channel, and how fast.
Spreadsheet of fraud contacts: One phone number and an email address.
Directory kept by every recall: Which bank answers by phone, which by email, which needs its BSA officer.
Spreadsheet of fraud contacts: Often blank.
Directory kept by every recall: The after-hours line, or a note that there is none, and the on-call supervisor.
Spreadsheet of fraud contacts: Anyone can edit a cell.
Directory kept by every recall: A change is proposed and confirmed by a supervisor, and logged.
Spreadsheet of fraud contacts: Looked up by a person while the clock runs.
Directory kept by every recall: Offered by the agent the moment a bank goes quiet, with a call script.
Which message recalls a Fedwire payment?
A camt.056, answered by a camt.029. The Fedwire Funds Service moved to ISO 20022 on July 14, 2025, and the Federal Reserve Banks' format guidance states the rule: "Fedwire Funds Service customers should send a camt.056 to request the return of the amount of a previously settled payment order and should respond to such request with a camt.029 message to indicate if they will refuse the return request." If the beneficiary's bank agrees, the money comes back as a payment return, a pacs.004, which must carry a unique end-to-end transaction reference (UETR), the original payment's where it had one.
The map matters because a recall's speed depends on the other bank finding the original credit at once. On Fedwire, the IMAD of the original message and its UETR are the keys; on FedNow, the request must refer to the original instant payment message. How each field of the request does its job is set out in the wire recall request, field by field.
The message map for a fraud recall on Fedwire and on the FedNow Service
| Fedwire Funds Service | FedNow Service | |
|---|---|---|
| Request for return | camt.056 | camt.056 return request; for fraud, reason code FRAD |
| Answer | camt.029, including to refuse | camt.029: accepted, rejected, pending investigation, or partly executed |
| Money back | pacs.004 payment return, with the original UETR | pacs.004 payment return, through the FedNow Service |
| What ties it to the payment | The original IMAD and UETR | The original instant payment message (pacs.008) |
| Published answer time | None in the format guidance | By midnight ET of the next standard business day; a pending answer finalized within 10 business days |
| Time limit to ask | None in the format guidance | 60 calendar days from settlement, a guideline that does not apply to fraud reports |
| Indemnity | UCC 4A-211(f): the sender is liable for the agreeing bank’s losses and expenses; the bank may ask for it in a signed indemnity | Sending a request may create 4A-211 liability unless the message disclaims it |
How do you recall a FedNow payment?
With a camt.056 return request, because the payment itself cannot be undone. FedNow and RTP payments are irrevocable, as the Philadelphia Fed's Consumer Compliance Outlook notes in comparing the two services, so the sending bank asks and the receiving bank decides. For a fraud report, the request carries reason code FRAD and is exempt from the 60-day guideline; the receiving bank is asked to answer by midnight Eastern on the next business day, and may say the request is pending while it investigates. If it agrees, it returns the money with a pacs.004 through the service.
The receiving side is the larger operation for many banks: a desk that sends a handful of wire recalls a day may receive hundreds of instant payment return requests a month, each with its own clock. The sample bank sees about 900 a month in both directions. How to answer them is set out in instant payments recall vs return.
Who signs indemnities, and up to what amount?
Someone with written authority, who did not prepare or approve the return instructions, at a limit the bank sets. A beneficiary's bank that agrees to cancel a payment it has accepted can look to the sender for its losses and expenses under UCC 4A-211, and in the sample, the beneficiary's bank returned the frozen money only on receipt of a signed indemnity. The amount, the template and the signer therefore belong in the day-one inputs, with an on-call signer for after hours. In the sample bank's settings, a supervisor approves every indemnity and an authorized signer, the SVP of payment operations, signs above $100,000; nobody signs one they prepared or approved.
Roles and separation of duties: who may prepare, approve, sign and export
The indemnity itself, what it covers and when it can be disclaimed, is the subject of the recall and hold harmless letter.
What law enforcement needs in the first referral
The facts FinCEN lists as required, gathered while the recall runs rather than after. For a Rapid Response referral involving a foreign beneficiary account, FinCEN's fact sheet says the complaint to law enforcement must include the victim's account name and number, the victim's bank and the country of the branch that sent the wire, the beneficiary's account name and number, the beneficiary's bank and its branch country, the date of the wire, the currency and amount, and a summary of the fraud. It recommends more where available, such as the SWIFT payment reference and the correspondent and intermediary banks.
Most of that is already on the recall: the payment order, the other bank's answer, the onward accounts. In the sample bank's settings, an international wire of $50,000 or more triggers a law enforcement referral pack within 72 hours of the payment, prepared by the Trace agent and sent by a person. FinCEN's 2019 advisory also asks banks to be ready to share what they know with each other: "Financial institutions should be prepared to provide transactional details and cyber-related information surrounding the BEC scheme when requesting assistance in recovering funds." A bank registered for information sharing under section 314(b) of the USA PATRIOT Act can do that with other registered banks under a safe harbor, for the purposes the rule allows, so registration belongs on the day-one list too.
After hours, and Fedwire on Sundays from 2028 or 2029
Instant payments already run every day of the year, and Fedwire is moving toward longer hours, so a recall desk needs a plan for nights and weekends. In November 2025 the Federal Reserve Board announced that the Fedwire Funds Service will run 22 hours a day, six days a week, Sunday through Friday including weekday holidays, opening at 9:00 PM Eastern on the day before each business day and closing at 7:00 PM. It expects the Reserve Banks to implement the change in 2028 or 2029, and participation in the expanded hours will be optional; today's cutoffs and the move are set out in Fedwire cutoff time and 22x6.
"Some commenters noted that in the current operating environment, fraud risk is often greater during weekends and holidays, and that institutional risk controls will need to adjust to anticipate automated and staffing solutions during extended hours."
Federal Reserve Board, notice on Fedwire Funds Service operating hours, November 2025
The practical inputs are an after-hours fraud line for each counterparty or a note that it has none, an on-call supervisor and signer, and clocks that know which banks are open. The sample bank's settings send anything outside 7:00 AM to 6:00 PM Eastern and at weekends to the other bank's after-hours line and its own on-call supervisor.
Where Wire & Instant Payment Recall fits, and where it does not
It fits across the inputs above, not in place of them. It reads the payments hub, the Fedwire, SWIFT and instant payment gateways, the core banking system and case management; drafts the request on the right rail; keeps the bank directory and its clocks; drafts return instructions and indemnities from the bank's templates; and builds the referral pack and an examiner's export from an audit trail nobody can edit. Every send, hold, return, credit and customer update has a maker and a different checker, and the agents never contact a customer or law enforcement.
It does not replace the gateways or the payments hub, set the bank's signing limits, decide who bears a loss, or make another bank answer. The contact sheet starts as the bank's own list and improves only as recalls run, and the connections to the bank's own systems are the first piece of work in any pilot. The fair test is the one the solution page offers: run it on a sample of the bank's own past recalls and return requests, and compare the minutes.
Whether or not software is involved, a desk can test its own readiness against the list below in an afternoon. Each item is a question someone will otherwise have to answer while a customer's money is moving.
A day-one readiness check for a wire recall desk
- Can you reach a fraud desk at your ten most frequent counterparties after 6:00 PM?
If not, find out who has no after-hours line before the night you need it.
- Does every counterparty record say which channel works fastest?
Phone, fraud mailbox or a message on the rail; the record should come from real recalls, not a directory.
- Is a change to a bank’s contact details confirmed by a second person?
A forged email can redirect a recall the same way it redirected the payment.
- Do you know your FedNow authorized fraud contacts, and theirs?
Operating Circular 8 requires each participant to name them.
- Is there an on-call approver and an on-call signer tonight?
With the indemnity template and the limit above which the signer must sign.
- Can you find a payment by its IMAD or UETR in under a minute?
The request has to refer to the original payment, and these are the references that let the other bank find the credit.
- Are you registered for 314(b) information sharing this year?
The notice to FinCEN lasts one year and has to be renewed.
An audit trail of people, agents and banks, and a masked export pack for examiners
Questions people ask
What is a Fedwire return request?
It is the ISO 20022 camt.056 message a Fedwire participant sends to ask another to return the amount of a payment that has already settled. The receiving participant answers with a camt.029, and if it agrees, sends the money back with a pacs.004 payment return.
Who should be on a bank’s after-hours recall list?
The other banks' after-hours fraud lines, an on-call supervisor who can approve a request, and an on-call signer for indemnities above the bank's limit. Without the last two, a request can be drafted at night but not sent or completed.
Do banks share fraud contacts with each other?
For FedNow, yes in part: Operating Circular 8 requires each participant to name authorized persons for fraud reports and lets the Reserve Banks share those contacts with other institutions. For wires there is no such list, so desks build their own from past recalls and correspondents.
What should a pilot of wire recall software use?
The bank's own past recalls and return requests, its current contact list, its approval and signing limits and its indemnity templates. Measure report-to-request minutes and answer times by bank before and after, on the same cases.
Does a bank need separate processes for FedNow and RTP?
The shape is the same: both are irrevocable credit-push services using ISO 20022, so recalls are requests the receiving bank may decline. Each network has its own rules and response guidelines, and a desk should map both; this page covers the FedNow rules, which the Federal Reserve Banks publish.