Case #PR-2026-008 — a $412,000 wire frozen before it left the bank

The loss. The client, a retired operations manager, was recruited through a professional network and introduced to an "investment advisor" with a polished portal, daily performance charts, and a compliance team he could "speak to." The platform grew his paper balance for weeks. When he requested a full withdrawal of his $412,000, the portal required a one-time "liquidity settlement" of $46,000, wired to a named US firm. He wired it. The balance then vanished, and the portal's "support" line went quiet.

What we found in the first 48 hours

The client had the right documents: the SWIFT MT103 with UETR for the $46,000 settlement, his own bank's outgoing-wire confirmations for the earlier funding transfers, and the portal's deposit page (screenshot before it went down). That let us separate the real question from the noise:

• The anchor transfer. The $46,000 settlement wired to the "liquidity" firm was the cleanest target. The MT103 gave us the exact beneficiary account, the intermediary bank, and the UETR reference that makes a specific wire locatable across the network.
• The mule chain. The beneficiary account credited the funds, then split them across three downstream accounts within a single afternoon. Velocity plus layering is the signature of a mule ring, and each hop left a SWIFT record with its own reference.

The freeze that worked

This case turned on the receiving bank, not the scammers. We built one coordinated package and sent it to the three parties that can actually move money: the beneficiary's bank (a locate-and-freeze request with the mule pattern attached), the intermediary bank (a recall for the anchor transfer), and the FBI IC3 (the report that gives the banks a law-enforcement reason to act rather than just a customer complaint).

The mule accounts were still holding the funds when the requests landed, which is the only moment that counts. The beneficiary bank froze the downstream balances before they were pulled out, and the recall recovered the anchor transfer. What remained went to a civil demand against the mule accounts, coordinated with the assigned case agent.

The outcome

Funds were returned over six weeks as the bank completed the recall and the civil demand settled. The success fee was paid from the recovered amount, nothing was paid upfront.

What made the difference

• The UETR reference. Without the exact wire identifier, the ask is a generic fraud claim. With it, it is a locate-and-freeze on a specific transfer. The MT103 was the single most valuable document the client had.
• The accounts were still full. The client contacted us within days, before the mule ring pulled the balances. A freeze is only as good as the balance it catches.
• One package, three audiences. The bank compliance teams, the intermediary, and IC3 all received the same timeline formatted for their job. That consistency is what makes a bank act.