A payment leaves your account and lands somewhere unfamiliar. The confirmation email you expected never arrives. By the time someone raises the alarm, the funds have already moved on – possibly across two or three jurisdictions.
CEO fraud and invoice redirection are two of the most financially damaging cyber-enabled frauds targeting businesses today. The window for recovery is real, but it closes fast. Decisive action in the first hours – contacting your bank, preserving digital evidence, and engaging specialist tracing counsel – keeps more options open than any single legal instrument alone.
This guide walks through each response step in sequence: what to do immediately, what legal tools exist, how cross-border movement complicates recovery, and how to avoid the second fraud that follows the first.
What are CEO fraud and invoice redirection – and why do they overlap?
Both frauds hijack a trusted payment instruction. CEO fraud (also called business email compromise) involves an impersonated senior executive directing a staff member to make an urgent, confidential transfer to a controlled account. Invoice redirection substitutes the genuine supplier's bank details with fraudulent ones – often through a compromised email account or a convincing lookalike domain. The overlap is significant: attackers increasingly combine both methods, spoofing the CEO's authority to rubber-stamp a redirected invoice.
In our experience, the losses discovered on a Monday morning relate to instructions sent on a Friday afternoon. That timing is deliberate. The gap between instruction and discovery is the attacker's runway.
What distinguishes these frauds from other theft is the victim's own authorisation. The payment is processed correctly by the bank; no technical fraud has occurred in the banking system's eyes. That distinction matters for recovery, because the victim's bank may have followed instructions it had no reason to query. Recovery therefore depends less on reversing an error and more on tracing where the money went and applying legal pressure at choke points along that path.
Step 1: The first two hours – what to do before anything else
The single most important action in the first two hours is a direct telephone call to your bank's fraud team – not an email, not a portal message. Banks can recall or freeze outbound payments if the receiving account has not yet been swept, but this window is measured in hours, not days. Have the payment reference, the beneficiary account details, and the exact amount ready before you call.
While that call is in progress, a second person should be doing three things in parallel:
- Saving all emails, messages, and documents related to the fraudulent instruction – do not delete, move, or alter anything.
- Taking full-header screenshots of the spoofed email (right-click, view source, save as text).
- Securing access to the email account or system that was compromised – change passwords and enable two-factor authentication, but do not wipe the device.
A practical point many victims miss: call the genuine supplier or counterparty using contact details from a previous, verified communication – not from the email chain in question. Confirm whether they sent the instruction. That call often resolves the question of fraud within minutes and gives you a witness statement you will need later.
Do not notify other staff unnecessarily at this stage. Wider disclosure before you have secured the evidence trail can allow a perpetrator with insider access to delete records.
Step 2: Reporting – who to contact and in what order
Reporting to your bank is necessary but not sufficient. The myth that a bank report alone triggers recovery is one of the most costly misunderstandings in fraud response. Banks are obligated to make a recall attempt; they are not investigation bodies and they cannot compel foreign banks to hold funds.
The reporting sequence that preserves the most options looks like this:
- Your bank (immediate – same call as Step 1).
- The receiving bank, through your bank's correspondent channels – your bank should initiate this, but confirm they have done so.
- Your national financial-intelligence unit or police cybercrime unit – a formal report creates a reference number that supports subsequent legal applications.
- Specialist recovery counsel or a cross-border asset-recovery firm – within hours where the loss is material, because the legal tools available change depending on whether funds are still traceable in the banking system.
In a matter we assisted in the Gulf region, spring 2025, involving funds in the mid-six figures, the victims had reported to their bank promptly but had not contacted the receiving bank's jurisdiction directly. By the time a freezing application was ready, the account had been swept. The bank report alone bought no time. Parallel action – bank recall plus legal freeze – was the combination that would have made a difference.
For a confidential read on whether your situation is still within a recoverable window, contact info@axiomtracel.com.
What legal instruments can freeze the funds?
The legal tools available depend on where the money has gone and how quickly you move. Three instruments are most relevant in the immediate aftermath of CEO fraud or invoice redirection.
A worldwide freezing order is an interim court order that prevents a defendant from dealing with their assets anywhere in the world. It is typically granted without notice to the defendant – so as not to trigger further dissipation – and can be obtained within hours of an urgent without-notice application in jurisdictions with well-developed commercial courts. The applicant must show a good arguable case and a real risk of dissipation.
A proprietary injunction goes further: it asserts that the claimant has a proprietary interest in the specific funds – that the money still belongs to the victim. This is a stronger claim in some respects, because it does not depend solely on the defendant's personal obligation to pay.
Where the identity of the fraudster is not yet known – which is common in invoice redirection – a proprietary injunction against persons unknown can be sought. Courts in several common-law jurisdictions have granted such orders in fraud cases, including where the fraud was conducted entirely online and the perpetrators' identities were not established at the time of the application.
For disclosure, a Norwich Pharmal order compels a third party – such as the receiving bank – to disclose the account holder's identity and account movement records. A Bankers Trust order is a closely related tool specifically directed at banks to disclose tracing information. Both can be sought in parallel with a freezing application, and the disclosure they produce feeds directly into the tracing exercise.
The cross-border dimension is critical here. If the money has moved to a foreign account, you may need to recognise and enforce a domestic freezing order in that second jurisdiction – or apply locally for a fresh order. Both routes take time and require local counsel in the relevant jurisdiction. Neither is automatic.
How does cross-border movement change the recovery picture?
Most CEO fraud and invoice redirection losses do not stay in a single jurisdiction for long. The typical pattern – in our experience – involves a receiving account in one country, a swift sweep to a layering account in a second jurisdiction, and conversion to a different currency or asset class within days. By the time a legal application is ready, the trail has crossed at least one border.
That movement creates what practitioners call jurisdiction friction: the tools available in one forum do not automatically reach assets in another. A domestic freezing order does not bind a foreign bank unless it is recognised or re-obtained in that foreign court. The process of recognising and enforcing a foreign judgment or order is governed by the law of the jurisdiction where the assets sit – not the law of the court that issued the order.
Where funds have entered the banking system of a civil-law jurisdiction, the procedural requirements differ materially from common-law forums. Timing, evidence standards, and the nature of the application all vary. Coordinating simultaneous applications across two jurisdictions – one to freeze, one to preserve – is technically demanding but sometimes the only way to prevent a second sweep while the primary application proceeds.
What changes the picture positively is correspondent banking. Large international payments travel through correspondent banks, and those banks hold records that can be accessed through letters of request or court-ordered disclosure. Those records provide the intermediate routing steps that a simple bank statement does not show – and they survive even after the end-recipient account has been emptied.
To assess the tracing options for funds that have already moved internationally, contact info@axiomtracel.com for a feasibility review.
Does the response change if funds were sent in crypto or converted after arrival?
Invoice redirection proceeds rarely start in crypto – but they often end there. A common layering step is to withdraw cash from the receiving bank account and purchase crypto assets, which are then moved through a series of wallets before being cashed out at a virtual-asset service provider (VASP) in a different jurisdiction.
That conversion does not make recovery impossible. Public blockchains record every transaction. Even when identities are obscured, on-chain tracing using blockchain-analytics tools can follow the movement of funds across wallets, identify clustering patterns, and attribute wallets to known VASPs or exchanges. That attribution then supports a disclosure order against the VASP – compelling it to reveal the identity of the account holder who cashed out.
A freezing order over digital assets can be granted in jurisdictions that have addressed crypto in their interim-relief jurisprudence. Courts have also granted proprietary injunctions over digital assets, and in some cases have ordered service of proceedings by NFT or airdrop where the defendant's wallet address is known but their identity is not. Stablecoin issuers can, on appropriate legal process, freeze specific token balances – a choke point that is sometimes faster than a court order over a VASP account.
The key practical point: do not assume that crypto conversion ends the trail. It changes the tools required, not the direction of travel.
How to recognise – and avoid – a recovery scam
The period immediately after a fraud is when victims are most vulnerable to a second fraud. Recovery scams are structured to intercept people at exactly this moment. They offer guaranteed fund return, claim to have special access to banking systems or law enforcement, and charge upfront fees before delivering nothing.
Legitimate asset recovery does not work that way. No honest recovery firm guarantees an outcome. Recovery is conditional on the specific facts of each matter – where the money went, how fast, which jurisdictions are involved, and whether the perpetrators are identifiable. Any firm that promises a recovery percentage or asks for a large upfront fee before establishing the factual basis of your matter should be treated with the same suspicion as the original fraud.
The realistic picture: disciplined first steps – bank contact, evidence preservation, legal advice within the first hours – materially improve the probability of reaching the funds. That is not a guarantee. It is an honest description of where effort has the most impact. What genuinely differentiates recovery firms is their ability to trace across borders, engage with foreign courts and banks, and move quickly under the urgency that fraud matters require.
Explore our broader fraud response resources for guidance on related fraud types and first-response steps.
Self-assessment: is your matter still within a recoverable window?
Not every matter is recoverable, and the honest answer to that question depends on facts you may not have assembled yet. The following signals indicate that recovery options remain open:
- The fraud was discovered within days of the payment.
- The receiving bank account has been identified and is in a jurisdiction with functioning commercial courts.
- The email evidence and payment records have been preserved without alteration.
- No prior report has inadvertently tipped off the fraudster or prompted erasure of records.
The following signals narrow the window but do not necessarily close it:
- The funds have been swept from the receiving account but a crypto conversion trail exists.
- The receiving jurisdiction is outside common-law courts but has treaty arrangements for mutual legal assistance.
- Several weeks have passed, but the perpetrators' identities have since been established through open-source or forensic means.
A feasibility assessment takes the specific facts of your matter and maps them against the legal and tracing tools available. It does not promise recovery – it tells you honestly whether the case has the characteristics that have supported successful tracing in comparable situations. You can request that assessment at axiomtracel.com/services/feasibility-report/.
You may also find it useful to read our analysis of investment fraud recovery routes, which illustrates how jurisdiction selection affects the tools available – a question that arises in cross-border invoice fraud as frequently as in investment cases.
Frequently asked questions
Q: What should I do in the first hours after a fraud?
A: Call your bank's fraud team directly by telephone and request an urgent payment recall. At the same time, preserve all emails, messages, and documents connected to the fraudulent instruction – do not delete or alter anything. Contact specialist recovery counsel if the loss is material. Reporting to a financial-intelligence unit creates a formal record that supports subsequent legal applications. Time is the variable you control most in the first hours.
Q: Is my loss realistically recoverable?
A: Recovery depends on specific facts: how quickly the fraud was discovered, where the funds moved, whether the receiving account is still funded, and whether the trail survives in banking or on-chain records. No outcome is guaranteed. In our experience, matters where disciplined first steps are taken within hours present materially more options than those where days have passed before specialist advice is sought. A feasibility report assesses your matter honestly against these variables.
Q: How do I avoid a second, recovery-focused scam?
A: Treat any unsolicited approach from a recovery firm with the same caution as the original fraud. Legitimate asset-recovery specialists do not guarantee recovery, do not promise a percentage, and do not ask for large upfront fees before understanding the facts of your matter. A genuine firm will tell you honestly whether your case has the characteristics that support tracing and legal action – and will explain exactly what the process involves before asking for a commitment.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the matters where fast, structured action is taken in the first hours leave more legal options intact than those where reporting alone was the first response. We have assisted clients across a range of sectors and geographies where the trail crossed multiple jurisdictions before it could be addressed. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review