The Day After a Bad Wire, Everyone Asks for the File

The worst day in escrow runs on a schedule.

Morning: the discovery. A payoff lender calls about funds that never arrived, or a seller asks where her proceeds went. Midday: the scramble. Recall requests to the sending bank, calls to the receiving bank, a report to the FBI's IC3, everyone hoping the money has not already hopped accounts.

Afternoon, and every day after: the questions. The bank wants your account of the transaction. The E&O and crime carriers want a timeline and your procedures. The principals' attorneys want to know what you knew. Eventually, the DFPI wants the file.

Different letterheads. Different tones. Underneath, each one asks the same things: what did the office know, what did it check, what stayed open, and who decided to release — when, and on what basis.

One artifact can answer. It was either built before the wire, or it does not exist.

Why escrow should care

The day after is not hypothetical for this industry. It is the scenario your coverage, your license, and your client relationships are priced against.

An independent office carries the exposure alone — no national-brand legal department, no balance sheet that shrugs off a trust shortage.

In that position, the review record is the closest thing to a shield an office can build for itself. Not because a page changes what a criminal does. Because it decides what the office is in every proceeding that follows: a careful operator with a documented review and an honest open item, or a set of assertions nobody can check. Same office, same people, same fraud. The file decides which one shows up.

The recovery window is real, and it is not a plan

The fair thing first, because the first hours matter. Money that has not finished moving can sometimes be stopped. INTERPOL's Operation First Light 2026 intercepted USD 293 million this spring, including a USD 6.6 million business-email-compromise transfer frozen through its rapid stop-payment channel. Singapore's Anti-Scam Centre averted more than $38 million in two months by reaching banks before transfers completed.

Speed works — sometimes.

But look at the verbs in those releases: intercepted, averted, foiled. Every success happened before or during movement, through machinery escrow offices do not control. Once funds settle and disperse, a recall is a request the receiving bank has no obligation to honor, as our wire recall guide lays out.

Buy the lottery ticket. File fast, call everyone. Do not mistake it for a plan.

One piece of the scramble can be drafted in advance: the first-hours contact sheet. The sending bank's fraud line, the office's carriers, counsel, the reporting channels — printed and current, so the worst morning spends its minutes calling instead of searching. That sheet is the only part of the bad day that can be written on a good one, besides the file itself.

Because the plan is what happens next. And what happens next runs on the file.

Memory versus record

Requests from a bank, carrier, principals, counsel, and regulator converge on one review record.

Here is the transformation nobody warns officers about.

The day before a bad wire, "I confirmed it with the seller" is a professional's routine statement. The day after, the identical sentence is a contested claim from an interested party. Not because anyone thinks the officer is lying — because every listener is now obligated to treat memory as memory. The adjuster's coverage decision, the examiner's findings, the posture of every attorney involved: none of them can rest on recollection, and all of them will say so.

A contemporaneous record never undergoes that transformation. A note written at 2:12 on an ordinary Tuesday — number dialed and its source row, person reached, facts confirmed, one item retained open, reviewer, decision — is the same fact on the worst day that it was on the ordinary one.

Our reading of two decades of DFPI shutdowns found the pattern over and over: outcomes turned less on whether something bad happened than on whether the office could show what it did and knew.

And the office that tries to write the record afterward discovers the cruelest part. An after-the-fact reconstruction is not just weak. It is suspect, and it reads as suspect to everyone trained to read files.

The file is the office's testimony, drafted in advance, by the only witness whose memory does not decay: the page.

What should be written down before money moves

Before the money moves, the file should answer five questions:

What changed.
What was checked, and against which source.
What stayed open.
Who reviewed.
What the office did.

This series has spent ten articles on the parts. The source and channel of each instruction. The conduct of each confirmation — number, source row, person, facts. Each change with its own re-check and succession note. Each open item retained in writing, with the name of whoever accepted proceeding. The release-moment page. Reviewer names and times throughout. Decisions stated as decisions — released, or held pending an owner exception.

Written that day, in the ordinary course, on every file. The day after a bad wire, this page is handed over — not reconstructed — and the office's account of itself stops depending on anyone's memory, including its own.

Operator takeaway

You cannot schedule the worst day. You can decide today what you will be holding when it arrives: a page, or a paragraph of recollections.

Build the record when nothing is wrong. That is the only time it can be built.

Money leaves.

The record stays.

— Sebastian Heyneman

Sources

Boundaries: INTERPOL and Singapore figures are as reported by those agencies, in consumer and commercial cases outside escrow; the Singapore amount is presumably Singapore dollars. The DFPI pattern is from our own working dataset of enforcement records — a working dataset, not a census. The worst-day schedule is a composite, not one office's story.