Walk the first hour, in order.

Trust-account wire fraud

A settlement or closing wire went to instructions from a spoofed email. Money has moved.

0 / 6 steps checked

1. 01Call the originating bank's fraud lineUse the number on the back of the card or the bank's published fraud line — not a number from any recent email. Ask for a SWIFT recall or hold on the outbound wire.
2. 02File at ic3.govThe FBI's Financial Fraud Kill Chain works best inside 72 hours. File even if you already called the bank.
3. 03Notify the receiving bank in writingReport suspected fraud on the receiving account. Some receiving banks will freeze funds pending investigation.
4. 04Preserve every artifactThe spoofed email with full headers, mailbox-rule changes, audit logs. Do not delete or forward the message.
5. 05Notify the client, in writing, todayModel Rule 1.4 and Formal Opinion 483 require the client be kept reasonably informed when their funds are affected.
6. 06Open the cyber and LPL claimsCheck whether funds-held-for-others is covered before assuming the loss is insured. Many cyber policies exclude escrow/IOLTA.