AegisAI Perspectives · 093
Within hours of a BEC wire transfer, a bank should send a recall request, file with IC3, ask for a Kill Chain freeze and start the SAR clock at detection.
Within hours of a business email compromise wire transfer, a bank should send a recall request to the beneficiary bank and report the wire to law enforcement, because FinCEN has had greater success recovering funds that are reported quickly9. AegisAI checks every payment request against the sender's history22, one of the controls in the email security guide for banks and credit unions. After a loss, export that sender history into the case file with the mailbox rules and login logs.
The FBI tells victims to contact the originating financial institution as soon as fraud is recognized, so the bank's recall comes first5.
The FBI says to request a recall of the funds along with any necessary indemnification documents1, such as a Hold Harmless Letter or Letter of Indemnity.
The FBI says to file regardless of the amount lost, as soon as possible. IC3 can help financial institutions and law enforcement freeze funds.
If the FBI's criteria are met, IC3 forwards the transaction details to a contact at the recipient bank and requests a freeze of the account4. Give the second hop details if you have them: IC3 then extends the request beyond the first recipient bank7. For a foreign beneficiary, IC3 works with the FinCEN Rapid Response Team and FBI legal attaché offices.
31 CFR 1020.320 requires an immediate telephone call to law enforcement for violations that need immediate attention, such as ongoing money laundering16.
The SAR is due no later than 30 calendar days after initial detection. With no suspect identified, the bank may take 30 more days, never past 60 calendar days. Use the key term BEC FRAUD and select field 42, Cyber event12. The IC3 complaint does not replace the SAR11.
Tell the customer the recall and the complaint are filed. No bank employee may disclose a SAR or anything that reveals one exists.
FinCEN asks banks to be ready with email addresses and IP addresses with timestamps.
BEC actors create auto-forwarding rules after stealing credentials, and unsynced rules may show only in the web client20. Keep mailbox login and settings logs for at least 90 days, the floor the NCUA sets for credit unions21.
Run the response on one clock that starts when fraud is recognised and ends with the SAR, due 30 calendar days after detection14.
| Hour | Action | Who | Source |
|---|---|---|---|
| Fraud recognised | Recall request and indemnity letter to the beneficiary bank, with a return request on Fedwire | Wire operations | FBI IC3 brochure |
| Right after the recall | Complaint at ic3.gov, regardless of amount | Fraud team | FBI IC3 PSA |
| With the IC3 complaint, if criteria are met | Financial Fraud Kill Chain freeze request, with second hop details | IC3 Recovery Asset Team, fraud team | FBI IC3 brochure; 2025 IC3 report |
| Ongoing scheme | Telephone call to the FBI or Secret Service field office | BSA officer | 31 CFR 1020.320 |
| Within 24 hours | Report to law enforcement complete | BSA officer | FinCEN advisory |
| Same day | Customer call: recall status, no mention of a SAR | Relationship manager | 31 CFR 1020.320(e) |
| Same day | Export forwarding and sweep rules, IP addresses, login logs | Customer's email admin, bank fraud team | FinCEN advisory13; FBI notice |
| Day 30, or day 60 at most | SAR filed with BEC FRAUD and field 42 | BSA officer | 31 CFR 1020.320; FinCEN |
In 2025 the Kill Chain covered 3,900 incidents with $1,163,919,846 in attempted theft, froze $679,013,183 and reported a 58% success rate6.
Illustrative example, figures are fictional. Cedar Ridge Community Bank (fictional) has a business customer, Hollis Supply (fictional), that sends a $184,000 Fedwire at 10:40 after an email from its "supplier" with new bank details. At 14:15 the real supplier calls Hollis to ask about payment. At 14:30 Cedar Ridge sends a camt.056 return request and asks for a Hold Harmless Letter. At 14:50 its fraud team files at ic3.gov with the beneficiary account and one second hop transfer of $61,000. At 15:20 Hollis's email admin finds an external forwarding rule that shows only in webmail. The BSA officer logs the detection date and sets the SAR due date 30 days out. The relationship manager tells Hollis the recall and complaint are filed, and nothing about a SAR.
Before Hollis sends its next payment, apply the call-back check in how a financial firm should check a payment change request that arrives by email.
AI agents check every payment request against the sender’s history, and stop the business email compromise that authentication lets through. The verdict rests on what this sender has sent you before and on the request itself25. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it.
Track three times for each BEC wire, from the system that stamps them.
To see a payment request checked against sender history on your own mail, use the AegisAI demo page.
Send a recall request to the beneficiary bank with an indemnity letter, file at ic3.gov regardless of the amount, and phone the FBI or Secret Service if the scheme is ongoing. Then log the detection date for the SAR and export the mailbox rules and logs.
It is the IC3 Recovery Asset Team's process for freezing wired funds. If the FBI's criteria are met, IC3 sends the transaction details to the recipient bank and requests a freeze. In 2025 it froze $679,013,183 across 3,900 incidents.
No. FinCEN says a complaint to IC3, the FBI or the Secret Service does not relieve a bank of its SAR filing obligations. The SAR is due 30 calendar days after initial detection, or at most 60 days when no suspect is identified.
No. 31 CFR 1020.320(e) bars any bank director, officer, employee or agent from disclosing a SAR or any information that would reveal one exists. Tell the customer about the recall and the IC3 complaint only.
Keep email addresses and IP addresses with timestamps, plus the auto-forwarding and inbox sweep rules. Check rules in the web client, where unsynced rules may only appear. NCUA guidance keeps mailbox login and settings logs for at least 90 days.
