If money moves and it is fraud, what is your role in the first four hours?

Two things run in parallel and neither waits for the other.

Your side, immediately: call the sending bank and request a recall, then report to the FBI's Internet Crime Complaint Center at IC3.gov. There is a federal process for attempting to freeze fraudulently wired funds, and it works far better inside the first 24 to 72 hours than after. Notify your underwriter and your insurance carrier promptly, because late notice is a common reason claims get reduced or denied.

Our side, immediately: contain the compromised account, revoke active sessions and tokens rather than only resetting the password, remove attacker-created rules and forwarding, check whether other accounts were touched, and preserve the audit logs before retention windows close. Then determine what was actually accessed, because that determines your notification obligations to affected parties and your state.

We also handle the technical side of the report your insurer and your underwriter will want: timeline, entry point, what was accessed, what was contained and when.

Decide in advance who has authority to make these calls at 6 PM on a Friday. We set that out during onboarding rather than discovering the gap during the event.