Follow the Money · 07 — The Wire: A Race Against the Clock

Follow the Money — Case 07. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Six cases in, the register has been mostly a story about cryptocurrency — ransoms and heists and mixers, value moving on public ledgers. Case 07 breaks that pattern deliberately, because the single largest category of reported financial loss in American cybercrime is not a crypto crime at all. It is a plain bank wire, sent by a real employee, to an account they believed belonged to someone they trusted. It is Business Email Compromise, and it is the register's proof that the biggest money is stolen through the most boring door.

The mechanism has no malware to detect and no exotic technology. An attacker gets into, or convincingly imitates, a trusted email account — a chief executive, a finance officer, a familiar vendor, the title company handling a house closing — and sends an instruction that looks entirely ordinary. Pay this invoice. We've changed our banking details, use these. Wire the closing funds to this account. An employee, seeing a name they know and a request they were half-expecting, does exactly what their job is: they send a legitimate payment. The only thing wrong is the destination. The money leaves the company's account and lands in a criminal's.

This is the letter about the race that starts the instant that wire is sent. Because unlike a crypto theft, a domestic bank wire can be recalled — but only if someone moves fast enough. The FBI runs a recovery machine that can reach into the receiving bank and freeze the money before it scatters, and it works remarkably well, on one condition: speed. The disposition is RECOVERED — but it is a recovery measured in hours, won or lost before the launderer has even finished the job, and it is the register's clearest demonstration that the fate of stolen money is often decided by a clock.

1. The Boring Door: how the biggest money leaves

Start with the counterintuitive fact at the center of the case, because it reorders everything the public assumes about cybercrime. The US Treasury's 2024 National Money Laundering Risk Assessment states that fraud — in the private sector and in government payments — is the largest driver of money-laundering activity by both scope and volume, generating billions of dollars annually, and it names Business Email Compromise among the cyber-enabled fraud categories doing it. Not ransomware. Not a crypto exchange hack. Fraud, and within it BEC, is the biggest engine of laundered money in the US risk picture. The most damaging cyber losses do not come through a zero-day exploit; they come through a well-written email.

The reason is where BEC aims. It targets the places where large sums of money move as a matter of routine, without anyone thinking twice: a corporation's accounts-payable department paying vendor invoices, a law firm's escrow account, a real-estate closing wiring a buyer's life savings to complete a purchase, a company updating a supplier's bank details. These are processes designed to move big money smoothly, which is exactly what makes them the perfect target. A consumer scam might net a few thousand dollars from a tricked individual. A single successful BEC against a business payment process can redirect hundreds of thousands, or millions, in one wire — because that is simply the size of the payments that flow through that door every day.

And the exploit is not technical, it is human. There is usually no virus, no breached firewall in the dramatic sense — often just a compromised or spoofed inbox and a request that fits the rhythm of normal business. The employee is not careless; they are doing their job, trusting a channel they trust a hundred times a day. The 2022 assessment noted how the pandemic's rushed, remote processes widened this exact gap, as verification steps that happened naturally in an office quietly disappeared. BEC is the crime that hides inside normalcy. It does not break the payment process. It rides it.

2. The Wire Leaves: the mule catches it

Follow the money the instant it leaves the victim's account, because the next few hours are the whole case. The fraudulent wire does not go straight to a criminal mastermind's personal account; it lands first in a money mule — a domestic bank account, opened in a real or synthetic name, whose entire purpose is to receive the payment and immediately move it onward. The mule is the buffer between the theft and the launderer, and the buffer is what the criminal is counting on.

The mule's job is speed and dispersal. As soon as the wire arrives, the account is drained: withdrawn as cash, split across several other accounts, sent abroad to a jurisdiction that will not honor a US recall, or converted into cryptocurrency to leave the banking system entirely. Each of those moves is a step further from the reach of anyone trying to claw the money back. The register notes the human complexity of this layer honestly: some mules are witting launderers taking a cut, but many are people recruited through fake work-from-home 'payment processor' jobs or through romance schemes, who genuinely do not understand that the money passing through their account is stolen and that they are committing a crime. The networks use them precisely because a real domestic account, in a real name, does not trip the alarms that a suspicious foreign transfer would.

Picture the timeline the mule is running, because it is brutally short. The wire posts in the morning. Within hours the mule receives an alert or a message from their handler and begins the drain: a cash withdrawal at a branch, an instant transfer to a second and third account, a purchase of crypto through an exchange app. By the afternoon the original account may already show a zero balance, and the money now exists in three or four places, none of them the account the recall was aimed at. The criminals design this fan-out to beat exactly the mechanism that would recover the money, and they have every incentive to move within the same business day — because they know, better than most victims do, that a domestic wire is only recoverable while it sits still. The mule is not lazy. The mule is racing the FBI, and usually winning by lunchtime.

This is why BEC is a race and not a chase. In a crypto theft, the money is on a public ledger and the trail, however obscured, persists for investigators to follow later. In BEC, the money is in a mule account that will be empty by tomorrow. There is no later. The single wire that is sitting, right now, in the receiving bank is recoverable in a way it will not be once the mule has done its work — and the mule works fast. Everything about whether this money comes home is decided in the narrow window between the wire arriving and the mule emptying the account.

3. The Kill Chain: the machine that beats the clock

Here is where the register offers something it rarely can — a mechanism that genuinely works, and works well. The FBI's 2023 IC3 report describes the IC3 Recovery Asset Team, the RAT, and its Financial Institution Partnership: on a detailed victim complaint, the RAT acts as a liaison to the receiving bank, requests a hold on the fraudulent transfer, issues a hold-harmless letter that gives the bank legal cover to freeze and return the funds, and coordinates a recall. The report calls it a symbiotic relationship between the FBI and domestic financial institutions, and that is exactly what it is: a pre-built pipeline that lets a victim's emergency reach the right person at the receiving bank in time to matter. This process is often called the Financial Fraud Kill Chain.

The kill chain's power is that it operates in the banking system's own real-time plumbing, not through the slow machinery of blockchain forensics or international legal assistance. A domestic wire can be held. A domestic bank can be reached by an FBI liaison in hours. A hold-harmless letter can be issued the same day. When the victim reports fast enough — the commonly cited threshold is roughly 72 hours, and sooner is far better — and the money is still sitting in that first receiving account, the RAT can freeze a large share of it and send it home. Year after year, the RAT recovers a meaningful fraction of reported BEC losses this way. It is, quietly, one of the most effective money-recovery mechanisms in all of cybercrime — and it exists because domestic wires, unlike crypto, run on rails the state can still reach into.

Trace one recovered case to see the pipeline work. A company wires a fraudulent 'vendor' payment on a Monday; on Tuesday morning an accounts-payable clerk notices the real vendor has not been paid and calls the bank, then files an IC3 complaint with the wire details. The RAT picks it up, identifies the receiving institution, and — because the partnership already exists — reaches a fraud contact there the same day, requesting a hold. The receiving bank, covered by the hold-harmless letter, freezes what remains in the mule account, and a recall returns it to the sender. The entire recovery hinges on two things having happened fast: the victim noticing within a day, and enough of the money still sitting in the first account. Neither is guaranteed, and both are functions of time — which is why the RAT's own guidance to victims is not 'gather evidence' but 'report immediately.'

But read the condition carefully, because it is the entire disposition. The kill chain works while the money is in the first account. It is a race against the mule, and the mule is fast. This is the structural truth of BEC that makes it different from every other case in this register: recovery is not a matter of eventually assembling enough evidence, as in the Colonial clawback, where the money sat on a ledger for the taking. It is a matter of getting to the bank before the money leaves. The disposition is decided not by the strength of the investigation but by the speed of the phone call.

4. The Cliff: what happens when the clock wins

The honest other half of the RECOVERED disposition is the cliff, and the register states it plainly because false hope here costs real money. Recovery in BEC does not decline gradually as time passes; it collapses the instant the money leaves the first account. Before the mule acts, a large share is recoverable. After the mule acts, almost none is. There is no gentle slope — there is a wall.

Trace where the money goes once it clears the mule and you are back in the world the rest of this register describes. The proceeds are layered across accounts, moved to jurisdictions that do not honor US recalls, and increasingly converted into cryptocurrency to exit the banking system entirely. At that moment the case leaves the fast, effective world of the interbank recall and enters the slow, uncertain world of blockchain tracing and mutual legal assistance — the world where recovery is the rare exception, exactly as it was in the crypto-native cases. The same BEC loss is a near-certain partial recovery if caught in 24 hours and a near-total write-off if caught in a week. The only variable that changed is time.

This is why the register frames BEC as the clock made visible. In most cases, the disposition of stolen money feels like the outcome of a long contest between criminals hiding and investigators seeking. BEC strips that away and shows the naked mechanism underneath: the money's fate is a function of speed, and the contest is usually over in days. It is also why the most important number in a BEC case is not the amount stolen but the hours elapsed before the victim picked up the phone — because that number, more than the sophistication of the attacker or the diligence of the FBI, decides whether the disposition reads RECOVERED or lost.

5. The Cheap Defense Nobody Runs

If recovery is a race the victim usually loses, prevention is a fight the victim almost always wins — and barely ever shows up for. BEC's defense is as low-tech as the crime: out-of-band verification. Before acting on a request to change banking details or send an unusual wire, call the requester back on a known, trusted number — not a number from the suspect email, not a reply to the suspect thread — and confirm the instruction with a human voice. That single step defeats the overwhelming majority of BEC attempts, because the entire exploit rests on the victim trusting the channel instead of verifying the instruction. Break that one assumption and the attack collapses.

The register dwells on this because BEC is the rare crime where the defense is nearly free and nearly total, and where most losses trace not to a clever attack but to a skipped verification. There was no unbreakable technology on the criminal's side. There was a spoofed email and an organization that did not call to check. This reframes the whole crime: BEC is less a triumph of attacker sophistication than a failure of a habit — the habit of confirming, out of band, that a payment instruction is real before moving money. Where that habit exists, BEC withers. Where it does not, a single well-timed email empties an escrow account.

And yet the habit is genuinely hard to institutionalize, which is the honest complication. Verification adds friction to processes engineered for speed; a busy closing, a rushed quarter-end, a CEO who does not like being questioned — each erodes the discipline. The register does not moralize about victims who skipped the call; the pressure to move fast is real and is exactly what the attacker exploits. But it does name the fix precisely, because unlike almost everything else in this series, the fix is known, cheap, and effective. The tragedy of BEC is not that we lack a defense. It is that the defense is a phone call, and the phone call is the thing everyone is too busy to make.

6. The counter-narrative, steelmanned

The strongest objection to this letter is that it makes BEC sound almost quaint — a solvable problem of phone calls and fast reporting — when the reality is a sophisticated, adaptive criminal industry, and it deserves a fair hearing.

The argument runs like this. Framing BEC as 'the boring door' and 'a race against the clock' understates the operators: they run long reconnaissance inside compromised inboxes, learn a company's payment rhythms, impersonate exactly the right executive at exactly the right moment in a real transaction, and deploy convincing spoofed domains and social engineering that would fool careful people, not just careless ones. The 'just verify out of band' advice, the argument continues, is glib — attackers compromise the phone-tree too, spoof caller ID, insert themselves into email threads so the 'known number' they supply looks legitimate, and exploit exactly the moments (a real closing, a genuine vendor change) when a callback seems redundant. And celebrating the RAT's recoveries, the argument concludes, risks complacency: the RAT recovers a fraction, the majority of BEC dollars are never returned, and leaning on 'the kill chain works' obscures how much simply vanishes.

The register grants the force of all of it and holds its ground. Yes, BEC operators are sophisticated at the human layer — this letter says the exploit is trust, not carelessness, and that the victim is doing their job; nothing here calls the crime easy or the victims foolish. Yes, verification can be attacked, which is why the register specifies a known, independently-sourced number rather than 'a callback,' and why it concedes the habit is hard to institutionalize under real-world speed pressure — the defense is cheap, not effortless. And yes, the RAT recovers only a share and most BEC dollars are lost — that is precisely the cliff the register centers, the whole point that recovery is partial and clock-dependent, not a solved problem. What the register will not concede is that the clock framing is therefore wrong. The sophistication is real and the recovery is partial, and both are true because the same fact governs them: BEC's money moves through a system fast enough to be recalled and fast enough to escape, so the outcome turns on speed. Naming that is not complacency. It is the single most actionable thing a victim can know — report in hours, not days — and the register would be failing them to bury it under an admiration of the attacker's craft.

7. Disposition — RECOVERED

Case 07 followed the money out the most ordinary door in the building: a legitimate wire, sent by a real employee, to an account they believed belonged to a trusted CEO or vendor or title company, on the strength of an email that was not what it seemed. The money did not vanish into a mixer or buy a warhead. It landed in a mule account and started a countdown — and everything about its fate came down to how fast someone noticed.

The disposition — the money's fate — is RECOVERED, but it is the most conditional recovery in the register. When the victim reports fast, within roughly the first 72 hours, and the money still sits in the receiving account, the FBI's Recovery Asset Team can reach into the domestic bank, freeze the fraudulent wire, and send it home — one of the most effective money-recovery mechanisms in all of cybercrime, and it works precisely because a bank wire, unlike crypto, runs on rails the state can still reach. But the recovery is partial and it lives on a cliff: the instant the mule withdraws, layers, sends offshore, or converts to crypto, the domestic recall has nothing to grab, and the case falls into the slow, losing world of blockchain tracing and cross-border requests. The same loss is a near-certain clawback in a day and a near-total write-off in a week.

Hold the plain lesson this case exists to deliver. BEC is the register's proof that the biggest cyber money moves through the most boring rail, that its disposition is usually decided in hours rather than through any long investigation, and that the two things that most determine whether it comes home are both unglamorous: a fast phone call to report the fraud, and — before it ever happens — a cheap phone call to verify the instruction. The honeypot beneath these words logs machines rattling doorknobs; BEC is a crime with no doorknob rattled at all, just a trusted voice imitated and a routine payment redirected. The vectors do not lie: the wire is real, the sender is fake, and the clock is running from the moment 'send' is pressed. Judge the network that hijacked the inbox. Then remember the two calls — the one that verifies and the one that reports — because in BEC, more than anywhere else in this register, the money's fate is not written by the cleverness of the crime but by the speed of the human response to it.

Follow the Money continues. Case 07 disposition: RECOVERED. Confidence: HIGH on the documented facts — fraud (including BEC) as the largest driver of US money laundering is stated in the Treasury 2024 and 2022 risk assessments; the IC3 Recovery Asset Team, its Financial Institution Partnership, the hold-harmless letter, and the recall mechanism are described in the FBI's 2023 IC3 report. The roughly-72-hour reporting threshold and the recovery-cliff dynamics are characterized as the well-documented time-dependence of the RAT process rather than a fixed guarantee; exact recovery rates vary year to year and are described in proportional terms. Victims are centered and not blamed; money mules are described across the witting-to-duped spectrum; no individuals are named. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the network, the wire, and the clock that decides whether the money comes home.