Business Email Compromise & Wire Fraud Investigation
If your business wired money to a fraudulent account or suffered a business email compromise, E3 Legacy Intel traces where the money went, identifies who is behind it, and documents everything for recovery and legal action. We are licensed investigators (FL A-1400197), and the recall window is short: act within the first 72 hours.
A wire sent to a fraudulent account is a live emergency, not a help-desk ticket. What you do in the next three days decides whether the money comes back. Below is the response, the investigation, and the recovery path.
The First 72 Hours
Call your bank now
Tell them the wire was fraudulent and demand a recall. Ask them to initiate a SWIFT recall on the receiving bank. Minutes matter.
File at FBI IC3
Report at ic3.gov and flag it for the Recovery Asset Team. Domestic wires over 50,000 dollars reported within 72 hours qualify for a freeze request.
Preserve everything
Do not delete a single email. Save full headers, the fraudulent invoice, and the payment instructions. This is the evidence the case is built on.
Lock the accounts
Reset credentials from a clean device, revoke active sessions and OAuth grants, and remove any hidden inbox forwarding rules the attacker created. Then put the controls in our business email compromise prevention and vetting guide in place so it does not happen twice.
Call an investigator
The bank recovers money it can freeze. Identifying who took it, and following it past the first account, is investigative work. Call us. Anyone who contacts you first and promises the money back for a fee is running a second fraud, and our guide to fake crypto recovery services lists the signs. When the diverted money is an employee's paycheck, the work is a payroll diversion fraud investigation.
What Incident-Response Firms Do Not Do, And What We Do
Cyber incident-response vendors tell you how the intrusion happened and close the hole. Valuable, but it does not get your money back and it does not name anyone. We identify who is behind the compromise, map the mule accounts the funds moved through, and follow the money to a standard that supports civil recovery, an insurance claim, and a law enforcement referral. When the payment instruction arrived by a cloned voice or a faked video call, we also authenticate the recording through our deepfake verification work.
We name the actors
We identify who is behind the compromise and the fraudulent accounts, not just IP addresses and log entries.
We follow the funds
We trace the transfer through the mule-account network to where the money actually went, and document each hop.
We build for recovery
Findings are packaged to survive a bank recall dispute, a John Doe suit, an insurance claim, and a law enforcement handoff.
The compromise reconstructed from the tenant records
Tenant review
Full Microsoft 365 and Google Workspace tenant review: sign-in logs, message trace, and audit records reconstructing the attacker timeline.
Rules and OAuth persistence
Analysis of malicious inbox rules, forwarding, delegate access, and OAuth application grants the attacker used to stay hidden and persist.
Initial-access determination
How the compromise started: phishing, credential stuffing, token theft, or a compromised vendor, so it can be closed and proven.
The Recovery Path
Bank recall and SWIFT
We support the recall and SWIFT process with the documentation banks require to act quickly on a fraudulent-transfer claim.
IC3 Recovery Asset Team
We align the filing with the FBI IC3 RAT process that can freeze funds at the receiving institution before withdrawal.
Civil routes
John Doe actions against the mule accounts, writs of garnishment, and fraudulent-transfer claims to claw the money back through the courts.
Insurance documentation
A loss package documenting the compromise, the transfer, and the causation your cyber or crime policy requires to pay.
Written for the business that just lost the wire
Real estate & title
Closing and escrow wire fraud, buyers, agents, and title companies. See our real estate wire fraud investigations.
Small business
The SMB hit by a vendor-impersonation or CEO-fraud wire, under the enterprise IR fee floor.
Law firms & escrow
Trust-account and settlement diversions, where a diverted client wire is also a bar-liability event.
Construction & vendor
Change-of-bank-details fraud on progress payments and vendor invoices across a project.
Finance & AP teams
Controllers and accounts-payable teams that approved a fraudulent payee and need answers fast.
Stay Protected
90-day post-incident monitoring
After every engagement we watch the recovered environment for 90 days: re-compromise attempts, new inbox rules, and credential reuse, so the attacker cannot quietly return.
Vendor-payment verification
An ongoing program that independently verifies new or changed payee bank details before you pay, killing the change-of-bank-details fraud that causes most BEC losses.
How These Cases Are Priced
Every case we take is a custom engagement, and every one is evaluated and quoted before work begins. Before anything is quoted, the case itself is evaluated in detail: how many accounts and institutions are involved, which jurisdictions are in play, what tactics the attackers used, and what recovery or litigation will actually require. Considerable analysis goes into every quote, because no two of these cases are alike. The figures here are starting points and honest ballparks, a framework for planning, and none of them is a final quote. A narrower engagement limited to an insurance claim evaluation starts at 5,400 dollars. Most full BEC investigations, tracing the stolen funds, establishing where liability sits, and building the case for recovery, run between 12,500 and 25,000 dollars. The most complex matters, multinational and multi jurisdictional cases involving dozens of transactions, advanced breach tactics, on site incident response, and forensic imaging, are quoted well beyond those ranges. Whatever the scope, the fee is flat, delivered in writing before work begins, and the written quote is the price.
Frequently Asked Questions
Can stolen wire funds be recovered?
Who do I call first after wire fraud?
Can you find out who is behind the BEC attack?
Do you support insurance claims?
How fast must I act after a business email compromise?
How much does a BEC investigation cost?
Results
A construction company owed $500,000 by a vendor lost the payment to an intercepted wire sent overseas; the forensic record we built led the vendor to pay half of the original invoice, the client recovered $250,000 it had every reason to believe was gone, and a relationship worth more than a million dollars of business survived. In a second matter a six-figure vendor payment had been sitting in an overseas bank for roughly a month before we were engaged, and the client recovered the full six-figure sum within a few weeks.
Two of our wire fraud matters are written up in full: a six figure wire, gone overseas, recovered in weeks, and a $500,000 loss and a partnership worth saving.
Your Examiner
Matt Aubin, CDFE, FBCI
Managing Partner, E3 Legacy Intel · FL Licensed Investigator A-1400197
Every matter on this page is worked under a named, licensed examiner. Matt Aubin brings seventeen years in cybercrime and open source intelligence. He is a Certified Digital Forensics Examiner (CDFE), a Florida Board Certified Investigator (FBCI), and a Certified AI Agent Developer, and he has investigated cases jointly with the FBI, the SEC, the U.S. Secret Service, and the U.S. Marshals.
His work has been featured on ABC News, Spectrum News, and The Daily Beast, and in a television pilot for Netflix and MAC Pictures as a cybercrime expert. He keynotes nationally and serves on the Board of Directors of the Florida Association of Licensed Investigators (FALI). About Matt Aubin
LET’S TALK
Bring us the problem. We will tell you plainly whether investigation can help.
Fill out this form and set up a discovery call with us. From there we will analyze the issues you are having and determine your intelligence needs. Then we will develop a custom, no-obligation quote for our services, delivered in writing before you commit to anything.
Tell us what happened
A licensed examiner reads every inquiry. You get a written, flat fee quote before any work starts. Or call (877) 732-6648.