How to recall a wire transfer: who does what in the first hour

To recall a wire transfer, the customer calls the sending bank at once, and the bank runs a recall: the work a sending bank does after a customer reports that a wire went to the wrong party, most often a fraudster who changed a supplier's bank details by email. The bank verifies the report, finds the payment, sends a request for return to the beneficiary's bank, chases every bank the money passed through, signs an indemnity if a bank agrees to give the money back, credits the customer and reports the crime. Written down it looks like a form. Run in practice it is a relay among five people at the bank and at least one fraud desk at another bank, and each hand-off costs minutes in the hours when money can still be frozen. FinCEN's Rapid Response Program says its best chance of stopping or recovering funds is when a fraudulently induced wire reaches law enforcement within 72 hours of the transaction, so the seat chart is really a question of speed.

Wire & Instant Payment Recall is Botminds' software for that relay. Agents match the customer's report to the payment, draft the request for return, keep a clock on every bank in the chain and follow money that has moved on. A specialist prepares and a different supervisor approves every send, hold, return and credit. The example on this page is a fictional bank, Corvane National Bank, and a fictional customer, Ashgrove Mechanical Contractors, running through the solution on sample data; none of its figures is a customer's measured result.

How do you recall a wire transfer?

It is seven moves, and only the third one is the recall message itself. The customer reports; the bank verifies the caller and the claim; the bank sends a request for return on the rail the payment used; it follows up with every bank in the chain until each one answers; it agrees the terms of any return, which usually means an indemnity; it posts the money and credits the customer; and, alongside all of it, the fraud team opens a case, reports to law enforcement and files a suspicious activity report.

The law sets the shape of the middle moves. Under UCC § 4A-211, once the beneficiary's bank has accepted a payment order, cancelling it needs that bank's agreement, and the sender is liable for the agreeing bank's losses and expenses. That is why the request is a request, why the other bank's fraud desk matters so much, and why a signer has to be available. The legal detail is set out in what a wire recall is, and how it differs from a cancellation; this page is about the people.

Minute 0 to 10: the report, the callback and the payment

The first seat is the person who answers the phone, and the first job is to make sure the report is real. A caller asking the bank to pull back a large wire is itself a moment a fraudster could exploit, so the report is confirmed by calling the customer back on the number already on file, not the number the caller gives. In the sample, Dana Whitcomb, the controller of Ashgrove Mechanical Contractors, called Corvane's treasury service line at 2:14 PM to say that the real supplier had just asked to be paid for an invoice Ashgrove had already wired. Lena Hargrove logged it and called back on the number on file at 2:16 PM. Without that callback, nothing else starts.

The report then has to become a payment. A good report carries what finds the wire: the amount, the time, the beneficiary as the customer entered it, and how the bank details arrived. Ashgrove's $186,000.00 Fedwire payment left at 12:02 PM. The agents found the payment order in the payments hub and its IMAD, the Fedwire reference that ties the request to the original message, and compared it with two years of Ashgrove's payments. It was the first payment ever to that account; eleven earlier wires to the same supplier had gone to a different bank, and the new details had arrived by email from a look-alike address three days before. Those facts are what the specialist and the supervisor need to believe the customer, and what the other bank will ask for.

The recall desk at 2:14 PM: the new report on top, with one button

Who approves a wire recall?

Someone other than the person who prepared it. A request for return looks like a message, but it can commit the bank: if the beneficiary's bank agrees to cancel, Article 4A makes the sender answerable for that bank's losses and expenses, and the beneficiary's bank may want that promise in writing before it returns anything. A recall therefore deserves the same dual control as a payment. The payment recovery specialist prepares it, a wire operations supervisor approves it, and an authorized signer signs any indemnity above the bank's own limit.

In the sample, Marisol Quintero prepared the request at 2:19 PM and Desmond Achterberg approved it at 2:21 PM; Fedwire carried it at 2:22 PM, eight minutes after the call. Desmond could not have approved it if he had prepared it, and the SVP who signs indemnities cannot sign one she prepared or approved. Those rules cost seconds when the people are at their desks. They cost the recall when they are not, which is why the on-call supervisor belongs on the after-hours list next to the other banks' numbers. What the indemnity says, and who should sign it, is covered in the recall and hold harmless letter.

Who do you call at the beneficiary bank?

Its fraud desk, after the formal message has gone. The request for return travels on the rail the payment used, so the beneficiary's bank has it in its queue with the original payment's references; the phone call and the email to the fraud mailbox are what get a person to read it. The sending bank needs a person who can decide to freeze an account, and that is the fraud desk's job, not the general customer line's.

What decides the next half-hour is knowing how each bank answers. In the sample, the request reached Lakemoor Savings Bank, the beneficiary's bank, at 2:25 PM through an intermediary. By 2:40 PM there was no acknowledgment, so the Follow-up agent sent a second message and emailed Lakemoor's fraud mailbox; at 2:44 PM it asked Marisol to phone, with a script, because Lakemoor answers fastest by phone. She called at 2:48 PM and Lakemoor acknowledged at 2:51 PM. A spreadsheet of contacts could hold the number. Knowing that this bank answers the phone and ignores email for an hour is something only kept response times can tell you. The contact sheet a recall desk needs on its first day is laid out in the contact sheet and message map.

The fraud investigator and the BSA officer work beside the recall

The recall tries to get the money back; the fraud case records what happened and who received it. They run in parallel from the first minutes, and neither waits for the other. A suspicious activity report is owed whatever the recall achieves: FinCEN's advisory on email compromise schemes says that with fraudulent payment instructions "a financial institution has a SAR filing obligation regardless of whether the scheme or involved transactions were successful, and regardless of whether the financial institution or its customers incurred an actual loss." The same advisory asks banks to put the key term "BEC FRAUD" in the narrative when a business is the victim.

Two rules shape how the fraud seat talks to everyone else. A suspicious activity report, and anything that would reveal one, is confidential, which is why the solution keeps a restricted review away from anything the customer or the client service officer sees. And banks that have registered with FinCEN may share information with each other under section 314(b) of the USA PATRIOT Act, which 31 CFR 1010.540 allows "for purposes of identifying and, where appropriate, reporting activities that the financial institution or association suspects may involve possible terrorist activity or money laundering", under a safe harbor and only after a notice to FinCEN renewed each year. For a fraud desk asking another bank what happened to the money next, being registered before the day it is needed is part of the seat.

When should law enforcement be contacted?

The same day, and in parallel with the recall, not after it fails. FinCEN's fact sheet on its Rapid Response Program tells victims to go first to their bank: "A victim should immediately contact their financial institution to report fraudulent activity and request assistance. Please do not contact FinCEN directly." The victim or the bank then files a complaint with the FBI's Internet Crime Complaint Center (IC3). The program itself starts only when law enforcement refers a complaint involving a foreign beneficiary account, so a domestic wire runs through the IC3 Recovery Asset Team instead.

The seats around law enforcement are therefore the fraud investigator, who prepares the complaint details, and the client service officer, who tells the customer what the bank has done and what the customer should file. Law enforcement can sometimes do what the sending bank cannot. The IC3's 2025 report describes an email compromise at a city government office in Oregon, with a reported loss of over $6 million: because an earlier freeze had flagged the same recipient account, the recipient bank notified the originating bank and asked it to confirm the wire instructions, "and the originating bank was able to issue a recall for the $6 million wire." In that case the information ran between three parties, and the recall still had to be issued by the sending bank.

"TIME IS OF THE ESSENCE!"

FinCEN, Rapid Response Program fact sheet, April 2026

Where the first hour is lost

Rarely in one step, usually in the gaps between them. The callback cannot reach the customer. The payment sits in a different system from the case. The supervisor is in a meeting. The fraud contact on the spreadsheet left the other bank last year. The beneficiary's bank acknowledges the message and then says nothing for an hour, and nobody notices because nobody is looking at the whole chain. Before the agents, the sample bank measured an average of 2 hours 38 minutes from a customer's report to the first message leaving, against a median of 9 minutes this month with them, on its own sample data.

The table is about effort. Elapsed time is a different number, because most of a recall is waiting on another bank, and the place to win it back is in noticing silence early. That is why the sample bank's settings ask for a second message at 15 minutes, a call at 30 and the supervisor at 60, and send anything outside 7:00 AM to 6:00 PM Eastern, or at a weekend, to the other bank's after-hours line and the on-call supervisor. The full minute-by-minute trace, including what the other banks did, is in how long a wire recall takes.

Eight agents, five people: how Wire & Instant Payment Recall splits the seats

The agents take the reading, matching, drafting and chasing; the people keep every decision that moves money or speaks for the bank. The Intake agent matches the report to the payment and stops without a callback on the number on file. The Recall agent drafts the request on the right rail and the return instructions, and nothing it drafts is sent without a maker and a checker. The Follow-up agent keeps the clocks and records how fast each bank really answers. The Trace agent adds a bank to the chain when an answer says money moved on and prepares the referral pack for law enforcement, which a person sends.

Four more cover the rest of the day. The Freeze agent reads requests other banks send in and proposes a hold of the lesser of the amount and the balance, which a maker and a checker decide. The Customer update agent drafts plain-language updates with no promise of recovery and nothing about a restricted review. A return-matching agent pairs returned money with its recall and proposes the entries and the credit. An Evidence agent builds masked export packs for examiners, internal audit, the BSA officer and law enforcement. Below each agent's confidence threshold, 0.85 for most in the sample settings, the agent asks a person.

Seven roles, each with what it may prepare, approve, sign, see and export

A first-hour checklist for the recall desk

Most of the first hour can be improved without new software, by deciding in advance who sits where and what each seat needs to hand on. These are the checks the sample bank's process encodes.

Prevention sits before all of this: callbacks on changed bank details and checks on unusual wires are the work of Wire Fraud Prevention, described seat by seat in how banks verify wire transfers, and routine questions about where a wire is belong to Wire Inquiry & Payment Tracking. Once a fraudulent wire has left, the seats on this page are the ones that decide how much comes back.

Questions people ask

What is the 72-hour rule for wire fraud?

It is guidance, not a legal deadline. FinCEN says it is most likely to interdict or recover funds when a fraudulently induced wire is reported to law enforcement within 72 hours of the transaction, and its Rapid Response Program works through foreign financial intelligence units for money sent abroad. The bank's own recall should start within minutes of the report, long before that window closes.

Does the bank file a SAR when a fraudulent wire is recalled?

Yes, if the reporting thresholds are met, whether or not the money comes back. FinCEN's 2019 advisory says the obligation applies regardless of whether the scheme succeeded or anyone lost money, and asks for the term "BEC FRAUD" in the narrative when a business was the victim. The report and anything that would reveal it stay confidential under 31 CFR 1020.320(e).

Can the customer call the beneficiary bank directly?

The customer can, but it is not a recall. Under Article 4A a sender sends its cancellation to the bank it gave the payment order to, and each bank then deals with the next one in the chain. A request from the sending bank, on the payment rail, carries the original payment's references; a customer's call gives the beneficiary's bank none of them.

What does the wire room do in a recall?

It sends the request for return through the Fedwire or SWIFT gateway, receives the other bank's answer and posts the return when it arrives. In the sample, the returned $142,000 was posted from Fedwire settlement to a wire recall suspense account before a maker and a checker approved the customer's credit. The wire room's references, the IMAD above all, are what tie every message to the original payment.

Who tells the customer what happened?

The client service officer who took the report, in plain words and at each change. In the sample, the update said what was frozen, what had already left, what happens next and what the customer could do that day, such as filing a complaint at ic3.gov. A supervisor approved it before it went out by secure message.