After a wire goes to a fraudster, the first call is to the bank that sent it, at a number already on file, to ask for a recall. The second step is a complaint at ic3.gov with the full transaction details, and the Federal Bureau of Investigation's Internet Crime Complaint Center puts both first in its 2025 annual report (page 17), which says "time is of the essence". Everything else on this page can wait until both are done. Threatbender is an education site and cannot recover money.
The call to the bank
The sending bank's fraud team can ask for a recall and contact the receiving bank. The annual report says banks differ in what help they give (page 17).
- Call the bank the wire went out from, using the number on the card, a statement or the bank's website, never a number from an email about the wire.
- Say the transfer was fraud. Ask for a recall of the wire, contact with the receiving bank about a freeze, and any indemnification documents the bank needs for the recall.
- Have ready the amount, the date and time it was sent, the receiving bank's name, the account and routing numbers given, and the reference number on the confirmation.
- Ask what this bank will do, and write down the answer, the time and the name of the person on the line.
The federal complaint
The complaint center asks for a complaint whatever the amount lost, and says it may be able to help banks and law enforcement freeze funds. Its Recovery Asset Team took up 3,900 incidents in 2025, involving $1,163,919,846 in attempted theft, and froze $679,013,183, which the annual report counts as a 58 percent success rate (page 17). Those figures count only the incidents the team took up.
The complaint center's alert of July 20, 2026 describes fake copies of its site promoted through fake social media profiles and AI-generated video. The real site is the one reached by typing ic3.gov into the address bar.
A closing wire still in the account
The annual report describes one of the incidents the team took up. In August 2025, people closing on a home received an email impersonating their attorneys and sent a wire of more than $449,000 (page 23). They reported the fraud to their bank, and the attorneys' own attempts to reach the receiving bank got nowhere. When the complaint reached the team, it asked the receiving bank to freeze the account, and the bank reported the full amount still there and on hold.
Everyone on the deal, by phone
When the wire was part of a purchase, the title company, the closing attorney and the agent may need to stop other payments. The numbers to use are the ones on file from before the deal, or on each firm's own website. The receiving account may be collecting from others too: in a Missouri case from March 2025 on page 23 of the annual report, the account that received a closing wire of more than $1.3 million had also received wires from other victims.
Someone else may be reading the email thread that carried the false instructions, so nothing about the loss goes back on that thread.
The mailbox
The Federal Trade Commission's steps for a hacked email account come in this order:
- Update the security software, run a scan, delete anything suspicious it finds and restart the computer.
- Follow the email provider's account recovery instructions.
- Change the password to a strong one that is hard to guess.
- Sign out of all devices, which removes anyone logged in elsewhere.
- Turn on two-factor authentication.
- Confirm that the recovery email addresses and phone numbers are ones the owner entered and can reach.
- Check the settings for forwarding rules, and delete any the owner did not set up.
When an employer or an outside provider runs the email, its administrator may hold sign-in records the user cannot see.
The evidence
The complaint center asks for the full transaction details, and a bank or an investigator may later ask for the rest of the record.
- Keep the emails with the false instructions, the texts, the call logs and the wire confirmation.
- Write down every name, phone number and account number the other side gave.
- Write a timeline the same day, while the details are fresh.
- Put the wire confirmation and the account and routing numbers into the complaint at ic3.gov.
Other reports
The Consumer Financial Protection Bureau's page on scams and fraud lists four places to go: the Federal Bureau of Investigation through ic3.gov, the Federal Trade Commission through ReportFraud.ftc.gov, the state attorney general, and the local police or sheriff. For anyone who wants to speak with an agent, the Federal Bureau of Investigation lists its field offices.
Offers to get the money back
The Federal Trade Commission's page on refund and recovery scams calls anyone who asks for an upfront fee a scammer, says government agencies never ask for money to help get a refund, and says scammers buy, sell and trade lists of people who have already been scammed.
- The complaint center's alert of August 13, 2025 describes fake law firms approaching cryptocurrency scam victims with claims of government ties. No law firm is an authorized partner of a US government agency, and the government charges nothing for law enforcement services.
- Its alert of July 20, 2026 says the complaint center never contacts people directly by phone, email, social media or chat, never asks for payment to recover funds, and never refers anyone to a company that does.
A message about a loss that claims to come from Threatbender and asks for a fee belongs in a report at ic3.gov.
What comes back
By the annual report's count (page 17), the Recovery Asset Team froze 58 percent of the attempted theft it worked on in 2025. In the August 2025 closing case above, the full amount was still in the receiving account when the team's freeze request arrived.
Sources
- Federal Bureau of Investigation, Internet Crime Complaint Center, "2025 IC3 Annual Report," pages 17 and 23. ic3.gov
- Federal Bureau of Investigation, Internet Crime Complaint Center, "FBI Warns of Scammers Impersonating the IC3," public service announcement, July 20, 2026. ic3.gov
- Federal Trade Commission, "How To Recover Your Hacked Email or Social Media Account," August 2023. consumer.ftc.gov
- Consumer Financial Protection Bureau, "Who do I contact for help with a scam or fraud?", last reviewed August 28, 2026. consumerfinance.gov
- Federal Bureau of Investigation, "Field Offices." fbi.gov
- Federal Trade Commission, "Refund and Recovery Scams," December 2023. consumer.ftc.gov
- Federal Bureau of Investigation, Internet Crime Complaint Center, "Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics While Offering to Recover Funds," public service announcement, August 13, 2025. ic3.gov