Business Email Compromise Recovery Fell to 58%. The Wire Recall Window, Measured

The FBI froze 58% of the money its Recovery Asset Team tried to stop in 2025, down from 82% in 2020. That decline is the most useful number in business email compromise recovery, because it measures speed rather than luck. BEC itself cost US victims $3.05 billion in reported losses last year. Most of that money was never inside the window where a freeze was possible.

What the FBI's 58% BEC recovery figure actually measures

The Recovery Asset Team, usually shortened to RAT, sits inside the FBI's Internet Crime Complaint Center. It was set up in February 2018 to speed up contact between law enforcement and the banks receiving fraudulent transfers.

When a qualifying complaint arrives, the team passes the transaction details to a designated contact at the recipient bank and asks for the account to be frozen. The bank responds, and the team informs the relevant FBI field office. That is the whole mechanism. It is a fast phone line between victim, FBI and recipient bank.

The 58% figure is the share of money that the team actually chased and managed to freeze. It is not the share of BEC losses recovered. It is not even the share of BEC losses the team looked at. Those are very different denominators, and the headline conflates them.

Frozen is not the same as returned

A freeze, which the FBI calls a monetary hold, stops the money leaving the recipient account. It does not move the money back to you. Getting frozen funds returned still runs through the recipient bank, and sometimes through a court order.

The FBI's annual reports publish the frozen figure, not the returned figure. I could not find a public number for how much frozen money eventually reached victims. Treat every rate in this post as a ceiling on recovery, not a measure of it.

The team only acts on complaints that reach it in time and meet its criteria. The money it pursued in 2025 came to about $1.2 billion, according to IBTimes UK's reporting of the FBI figures. That pool covers several fraud types, not only BEC. A victim who reported in week three, or who never reported, is not in the 58% at all.

BEC recovery rates since 2018, year by year

The team has published a freeze rate in most annual reports since it began. Laid side by side, the direction is plain.

Sources: FBI 2018 Internet Crime Report release; IC3 annual reports for 2020, 2022 and 2023; FBI Las Vegas field office for 2021; KSL and IBTimes UK reporting of the IC3 2025 report. 2019 and 2024 are omitted because no figure for those years could be traced to an FBI document during research. The FBI's 2018 wording called the result a recovery rate; later reports call it a freeze or hold rate.

Why the BEC recovery rate is falling

The FBI has not published an explanation for the decline, so what follows is my reading of the numbers rather than an official finding. Three things are visible in the data. A fourth is a hypothesis that I would want confirmed.

The volume grew faster than the team

The money the team pursued rose from $462 million in 2020 to about $1.2 billion in 2025, roughly 2.6 times as much. Frozen dollars rose from about $380 million to $679 million, a 79% increase. The team got better in absolute terms and fell behind in relative ones.

The part that got away is the number worth staring at. About $82 million escaped the freeze in 2020. In 2025 the figure was close to $500 million, about six times larger. If you run a finance team, that is the pool your own loss would sit in.

The 2022 report described the team's work as BEC complaints involving domestic-to-domestic transactions. The 2025 coverage describes attempted theft across fraud types that qualified for the process. A wider mix of cases, including international wires, is plausibly harder to freeze than domestic BEC. The FBI has not said so, which is why this is a hypothesis.

My view is that the decline is mostly real and partly compositional. Either way, the practical conclusion for your team does not change. The window is not getting longer.

The wire recall window, hour by hour

A wire recall is a request from your bank to the receiving bank to send the money back. It is a request, not a right. Once the receiving bank has credited the beneficiary account, the money is gone unless that bank agrees to freeze it or a court orders it.

The FBI's freeze process exists to make that request land before the money moves on. Its value decays with every hour the fraudster has to withdraw, split or convert the funds.

What the FBI says about timing

Robert Bohls, special agent in charge of the FBI's Salt Lake City field office, put it simply in a July 2026 interview with KSL. Call the bank first. Reporting within 48 hours is ideal, and the quicker the better.

For international wires, the Financial Fraud Kill Chain has published entry conditions. Guidance reproduced by the American Land Title Association lists four. The wire is $50,000 or more, it is international, a SWIFT recall notice has been initiated, and it happened within the last 72 hours. Wires outside those thresholds should still be reported, but that specific process cannot be used.

The single most useful dataset here does not exist in public. The FBI does not publish freeze rates by hours elapsed between transfer and report. So nobody outside the bureau can tell you whether a report at hour 6 does twice as well as a report at hour 30.

I would not wait for that data. The direction is not in dispute, and the cost of reporting fast is a phone call.

The BEC money that never reached the freeze

The 58% headline describes the money that got into the system. A bigger question sits upstream of it: how much BEC loss never entered the process at all.

The FBI does not split the team's pursued money by fraud type in the coverage I could verify. That makes a precise answer impossible. A floor is still available. Assume, generously, that every dollar the team pursued in 2025 was BEC. Then at least $1.85 billion of the $3.05 billion in reported BEC losses never reached it.

The same pattern shows in earlier years. In 2023 the team worked 3,008 incidents, against 21,489 BEC complaints in the same report. Not every RAT incident is BEC, so the true BEC coverage is likely lower than the 14% those two numbers imply.

Against total reported internet crime losses of about $20.9 billion in 2025, the $679 million frozen is roughly 3%. I do not read that as a failure of the team. I read it as proof that the recovery path is narrow by design, and that most victims arrive at it too late or not at all.

A wire fraud recovery runbook for the first hour

Every finance team has a payment approval process. Very few have a written process for the hour after a payment turns out to be fraudulent. That hour is when the 58% is decided.

The on-call runbook template we published for agent incidents applies here almost unchanged. Name an owner, write the steps down, and rehearse them before you need them.

Call the bank, not the inbox

The first call goes to your bank's fraud or wire operations line, by phone. Ask for a recall, ask the bank to contact the receiving bank directly, and get a case reference. The FBI officials quoted in 2026 coverage gave the same order: bank first, then the FBI.

Do not reply to the email thread that carried the fraudulent instruction. If the mailbox is compromised, the attacker is reading it. Move every conversation about the incident to phone or a separate channel until the account is secured.

File the complaint with everything the team needs

The team can only act on a complaint that carries enough detail to identify the receiving account. Collect it in one place before you file at ic3.gov, and send the same packet to your local FBI field office.

Export the email, the payment approval trail and the change log for the vendor record. Then read your crime or cyber policy for its notification deadline, which is often short. The way insurers treat a late notification is part of the argument in the piece on how insurers are underwriting AI failure.

BEC prevention changes that also shorten recovery time

Prevention controls get most of the attention, including in our own analysis of payment controls against deepfake CFO fraud. This section is narrower. It covers the changes that shrink the time between payment and discovery, which is the variable the FBI data says matters most.

Reconcile outbound wires the same day

The cheapest change most teams can make is a daily check of every outbound wire against the approved vendor record. It does not stop the fraud. It turns a three-week discovery into a same-day one, and that moves you from outside the window to inside it.

Survey data suggests the people best placed to do this already exist. The 2026 AFP Payments Fraud and Control Survey found 74% of US organisations were affected by BEC in 2025, from a sample of 465 treasury practitioners. A problem that common deserves a rehearsed response.

Ask your bank this week who handles wire recalls out of hours, and what it needs from you to start one. Write the answer into the runbook. A recall started on Friday evening rather than Monday morning can be the difference between hour 4 and hour 64.

The same thinking applies to the tools your team uses to approve payments. Unsanctioned apps that touch payment data widen the attack surface, a cost measured in the analysis of what shadow AI adds to breach costs.

Where this argument is weakest

The trend in this post is clear. The evidence under it has gaps, and they should be stated plainly.

The series is not like-for-like

The FBI's description of what the team handles has changed. The 2022 report talked about domestic BEC transfers. Later coverage describes a wider mix of fraud types. A falling rate across a changing mix might partly reflect harder cases rather than slower victims. I cannot separate those two effects with public data, and nobody outside the FBI can.

The 2025 figures come through press coverage

The 2025 freeze figures used here were verified through two news reports of the IC3 data, KSL and IBTimes UK, rather than the report text itself. The numbers agree with each other. They are still secondary sources, and the 2024 figure could not be traced to an FBI document at all, which is why it is missing from the chart.

Complaint data undercounts

IC3 numbers only include victims who chose to report. Large companies often handle incidents through their own bank and counsel and never file. The $3.05 billion is a floor, and the share of losses that reached the freeze process may be even smaller than the figures above suggest.

None of this reverses the practical advice. Faster reporting is never worse. What it does weaken is any claim that you can calculate your own odds of recovery from these figures. You cannot.

Frequently asked questions

Where to start

Pick one thing for this week and one for this month.

This week, call your bank and ask who handles a wire recall at 7pm on a Friday, and what they need from you to start one. Write the number and the answer on one page and give it to the two people who approve payments.

This month, add a same-day reconciliation of outbound wires against the vendor master. It costs an analyst perhaps 15 minutes a day. It is the only control on this page that directly moves you from outside the recall window to inside it.

Related reading