In 2025, the FBI's Recovery Asset Team froze $679 million in fraudulent transfers, about 58% of the roughly $1.16 billion it went after. (FBI IC3 2025 Internet Crime Report)
That number exists because speed matters. Once money moves, the window to claw it back is short.
Which is why harm assessment is part of investigation, not an afterthought. Once I know something is malicious, the questions change:
- Did money or data actually move?
- What did the attacker have access to, and for how long?
- Are they still in?
- Who else got the same thing?
A contained phish with no clicks and a live BEC with a wire out the door are both "phishing incidents." They are not the same emergency.
If money moved: call the bank immediately and file at ic3.gov. Don't wait to finish the investigation first.