Your client just wired money to a scammer — first 24 hours playbook

Hour 0-2: stop the bleeding

The moment you learn of the wire:

1. Contact the originating bank's wire room immediately. Not customer service — the wire room. Request an immediate 'wire recall' / 'SWIFT MT199' / 'fraud reversal request.' If the wire is still pending or the receiving bank hasn't released funds, recall is possible.

2. Contact the receiving bank if known. Many international banks will freeze incoming wires under fraud designation if reported quickly enough.

3. File at IC3.gov. The FBI's Internet Crime Complaint Center maintains the Recovery Asset Team (RAT), which has actually recovered hundreds of millions in the past few years on properly-filed fast reports. Speed is everything — within 72 hours is the official window for RAT engagement.

4. Don't waste time on perfect documentation yet. File preliminary; supplement later. Hours matter.

Hour 2-12: secure the rest of the assets

Place all available holds. If you're a broker-dealer, invoke FINRA Rule 2165 temporary hold on any further disbursements. Notify your custodian to flag the account. Consider Reg D 14b-3 hold equivalents.

Change account access. Reset online passwords and 2FA from a verified device (not the client's compromised device if there's any chance of remote access compromise). Consider locking all electronic access pending review.

Verify what else may be compromised. If the client provided any personal info to the scammer, place credit freezes at all three bureaus (Equifax, Experian, TransUnion) — free, takes minutes. Assume SSN and DOB are now in scammer hands.

Contact the Trusted Contact Person. If one was designated, this situation explicitly qualifies for TCP contact under FINRA Rule 4512.

Hour 12-24: official reports

Now that immediate containment is done, file formal reports:

State Adult Protective Services. Mandatory in most states; protected by Senior Safe Act.

State securities regulator. If investment-related (e.g., pig butchering, fake brokerage).

Local police. File a police report — this is often required for insurance claims and creates an official record.

FBI ic3.gov full report. Supplement the initial filing with full documentation.

State Attorney General consumer protection office. Some states have dedicated elder fraud units.

FTC reportfraud.ftc.gov. Federal data aggregation; doesn't drive specific recovery but contributes to broader enforcement.

Documentation requirements

Collect and preserve, immediately:

— Wire transfer records (date, amount, receiving bank, account name, account number).

— All communications with the scammer (texts, emails, screenshots — never delete).

— Account statements showing the transaction.

— Notes on how the scam unfolded (client interview, in client's own words).

— Names, photos, profiles of the scammer if available (often stolen real identities).

— Any URLs of fake platforms or investment sites.

— Cryptocurrency transaction hashes if crypto was involved.

Make a chronological event file. Save everything to a secure folder. This documentation matters for: insurance claims, bank disputes, law enforcement investigations, and tax reporting (theft losses can be deductible in some circumstances).

Communicating with the client and family

Many victims are deeply ashamed. Some are still in the scam emotionally — especially romance scam victims who may not believe it was a scam at all.

Approach:

— Lead with empathy, not judgment. 'This happens to brilliant people every day. We're going to do everything we can.'

— Don't blame. Even if their judgment was poor, shame closes the conversation and they'll hide future contact with the scammer.

— Be honest about recovery odds. Most isn't recoverable. Setting realistic expectations avoids a second scam (recovery scammers prey on victims).

— Recommend a fraud counselor. AARP fraud helpline (1-877-908-3360) and Cybercrime Support Network (cybercrimesupport.org) offer free, judgment-free counseling.

— Involve family carefully. If the client wants family involved, great. If they don't, respect that — but consider whether mandatory reporting trumps client preference in your state.

Beware the recovery scammers

Within days, your client will likely be contacted by 'recovery agents' or 'asset recovery firms' offering to retrieve the stolen funds. These are almost always second-stage scams targeting the same victim.

Red flags of recovery scams:

— Cold contact via Telegram, WhatsApp, email, or social media DM.

— Promises specific success rates ('85% recovery').

— Demands upfront fee before any work.

— Asks for wallet seed phrases or banking credentials.

Real recovery, when possible, happens through:

— The bank's fraud team and SWIFT recall process.

— FBI's IC3 Recovery Asset Team.

— A licensed attorney engaging a real blockchain forensics firm (for crypto cases).

Never anyone who cold-contacts the victim. Warn the client and family explicitly.

Long-term: hardening the account

Once the immediate crisis stabilizes, restructure the relationship:

— Implement a 'cooling-off' policy on disbursements above a threshold: required 24-hour delay and verbal confirmation.

— Require dual approval for all wires (advisor + supervisor).

— Reduce ACH limits if not necessary.

— Add or update Trusted Contact Person.

— Schedule more frequent client check-ins to surface scams earlier.

— Consider a family alert system — software that automatically notifies a designated family member when the client interacts with likely scam communications. This is the gap most firms don't fill.

Related for advisors