Fraud Response Toolkit: Freeze Requests, Dispute Letters, Reports, and Recovery Steps

Summary. Fifteen documents in urgency order. If money moved today, use Template 1 before reading anything else.

Use this in order

Templates 1–3 are for the first hour. Everything after them can wait.

Templates 4–6 are for the first week, and they are what turn a phone call into an enforceable claim.

Templates 11–13 take ten minutes and prevent most of this from happening again.

Two habits throughout: get a case number for every call, and confirm every verbal report in writing with proof of the date.

Template 1 — Fraud department phone script

Call the number on the back of the card or on the institution's website. Not the branch. Not the app chat.

Opening:

"I need to report fraud on my account. Funds left my account on [date] at approximately [time], in the amount of $______, to [recipient name and account if known]. I am requesting an immediate [recall / return / chargeback] and a freeze on any further transfers from this account."

Then, in order:

1. "Can you confirm whether the transfer has settled or whether it can still be stopped?"
2. "Please place a hold on any further outgoing transfers pending my confirmation."
3. "Please close this card and issue a new number." (if a card was involved)
4. "Please give me a case or reference number for this report."
5. "What is the direct number and extension to follow up on this case?"
6. "Please send me written confirmation of this report and of what I have requested."
7. "What is your deadline for me to submit a written dispute, and where do I send it?"

Record: date · time · representative's name and ID · case number · what they said about recoverability · deadlines given.

By method: wire → say "recall" · ACH → "return" · card → "chargeback" · payment app → report in the app and to the bank.

Template 2 — Wire recall request

Send immediately after the call, in writing, to the sending bank. Hours matter.

[Date and time]

RE: URGENT — Request for wire recall, Account No. [], Wire reference []

To: [Bank] Wire Operations / Fraud Department

I am reporting that the following wire transfer was fraudulently induced and I am requesting an immediate recall:

Field	Detail
Sending account
Amount	$
Date and time sent
Wire reference / IMAD
Beneficiary name
Beneficiary account number
Beneficiary bank and routing
Stated purpose

The circumstances. [Two or three sentences. "I received an email appearing to be from my title company providing updated wire instructions for a closing scheduled [date]. The instructions were fraudulent; the title company's email had been compromised."]

I request that you:

1. Transmit a recall request to the beneficiary bank immediately
2. Contact the beneficiary bank by telephone and request a hold on the funds
3. Place a freeze on further outgoing transfers from my account pending my written confirmation
4. Provide me the case number and the name of the person handling it

I have filed a report with the FBI's Internet Crime Complaint Center [confirmation number ____] and with [police department] [report number ____].

Time is critical. Please confirm receipt immediately.

[Name] · [Phone — reachable now] · [Email] · [Date and time sent]

Template 3 — Freeze letter to the receiving institution

[Date]

RE: URGENT — Fraudulently obtained funds, Account No. [beneficiary account]

To: [Receiving bank] Fraud Department

Funds fraudulently obtained from me were transferred to an account at your institution:

• Beneficiary account number: [ ]
• Beneficiary name as given: [ ]
• Amount: $______
• Date received: [ ]
• Sending institution and wire reference: [ ]

The transfer was induced by fraud. [One or two sentences describing the pretext.]

I request that you place an immediate hold on these funds pending investigation.

Reports have been filed with:

• FBI IC3, complaint number [ ]
• [Police department], report number [ ]
• [Sending bank], case number [ ]

Please confirm receipt and advise what further documentation you require. I can be reached immediately at [phone].

[Name] · [Contact] · [Date and time]

Template 4 — Written dispute (unauthorized transfers)

Send within two business days of learning of the loss if at all possible. Confirms the verbal report and triggers investigation obligations.

[Date]

RE: Notice of unauthorized electronic fund transfers — Account No. ending [____]

To: [Institution], [Fraud/Disputes address]

I am reporting unauthorized electronic fund transfers from my account.

Date	Amount	Payee / description
	$
	$
	Total: $

I did not authorize these transfers. I first learned of them on [date], and I reported them by telephone on [date] at [time] to [representative name], case number [____].

What happened. [Three or four sentences, factual. Include how the credentials or access were obtained if you know.]

I request that you:

1. Investigate these transfers
2. Provisionally credit my account for the disputed amount during the investigation
3. Provide written notice of your determination and, if you deny the claim, the reason in writing and copies of the documents relied on
4. Confirm my liability limit given the date I reported

Enclosed: police report number [ ] · IC3 confirmation [ ] · [screenshots, emails with full headers, transaction records].

[Name] · [Address] · [Phone] · [Date] Sent by [certified mail no. ____ / secure message with confirmation] on [date]. Copy retained.

Template 5 — Escalation after a denial

Use when the institution says the transfer was "authorized" because you were tricked into making it. This position is contested and it has been reversed on escalation.

[Date]

RE: Appeal of denial — Claim No. [], Account ending []

To: [Institution] Executive Complaints / Office of the President

On [date] I reported [amount] in transfers as fraudulent. On [date] you denied the claim, stating: "[quote the denial exactly]."

I am appealing that determination and requesting the following:

1. A written statement of the specific basis for the denial and the documents relied on
2. The investigation file, including any records reviewed
3. Reconsideration on the grounds below

Grounds.

[Select what applies.]

• The transfers were not authorized by me. [Explain — credentials were obtained by a third party; a session was hijacked; a payee was added without my knowledge.]
• Provisional credit was required during the investigation and was not provided.
• The investigation was not reasonable — I was not contacted, the documentation I provided was not addressed, and the determination issued in [N] days without any request for information.
• The institution failed to act on indicators of fraud — [an unusual transfer pattern; a first-time payee for a large amount; a series of transfers inconsistent with account history; my age and account profile].
• [If applicable:] The account holder is a vulnerable adult and [state] law authorizes a hold on suspected exploitation, which was not considered.

If this determination is maintained, please advise in writing. I will be filing with the [Consumer Financial Protection Bureau / OCC / Federal Reserve / NCUA / state banking department] and the [state] Attorney General.

[Name] · [Contact] · [Date] cc: [Regulator] · [State Attorney General]

Template 6 — IC3 narrative

The complaint form asks for a narrative. This structure gives investigators what they use.

1. What happened, chronologically. On [date] at [time] I received [a call / an email / a message] from [number, address, or platform]. The person identified themselves as [name and claimed affiliation]. They stated: [quote the pretext].

[Continue in dated, timed sequence through every contact.]

2. What I was told to do and why. [The urgency, the secrecy instruction, the payment instruction.]

3. The financial detail.

Date	Amount	Method	Sending institution & account	Receiving institution, account & routing	Beneficiary name
	$

(For cryptocurrency: exchange used, sending wallet address, receiving wallet address, transaction hashes.)

4. All identifiers used by the subject. Phone numbers · email addresses (with full headers preserved) · websites and URLs · platform usernames · company names claimed · names claimed · physical addresses given · any photographs used.

5. Reports already made. [Institution, case number, date] · [Police, report number, date].

6. Current status. [Funds recalled? Frozen? Released? Any partial recovery?]

For real estate or business wire fraud, include the phrase "BUSINESS EMAIL COMPROMISE" in the first line of the narrative.

Template 7 — Police report worksheet

Bring this. It makes a fifteen-minute report into a usable one.

FRAUD REPORT — [Your name], [date]

Total loss: $______ · Dates of loss: [ ] to [ ] Type: [ ] Wire fraud [ ] Romance [ ] Grandparent/family emergency [ ] Tech support [ ] Government impersonation [ ] Investment [ ] Business email compromise [ ] Elder exploitation [ ] Other

How contact was initiated: [ ] Names and identifiers used by the subject: [ ] Phone numbers: [ ] · Emails: [ ] · Websites: [ ] Payment detail: [table of date, amount, method, destination] Any physical contact? [Courier who came to the door — description, vehicle, plate, time] Any recordings, voicemails, texts, or emails retained? [ ] Institutions notified and case numbers: [ ] IC3 complaint number: [ ] Witnesses: [ ]

What I need from this report: a report number for my financial institutions and insurers.

Template 8 — Master incident log

Also log: every contact from the subject, with the exact wording · every institution's deadline · every promised callback that did not happen.

Six months from now, when a receiver's claims process opens or a prosecutor's victim coordinator calls, this log is the difference between a claim and a story.

Template 9 — Account security sweep

Do these in order. The order matters because email is the recovery channel for everything else.

EMAIL — do this first and completely

• New, unique password
• Multi-factor authentication on
• Check forwarding rules and filters — attackers hide a rule that forwards your mail; changing the password does not remove it
• Check the recovery email and phone on the account — attackers change these to lock you out later
• Review connected apps and revoke anything unrecognized
• Review active sessions and devices and sign out of all
• Check the sent folder for messages you did not send

THEN, in order of reach

• Banking · [ ] Brokerage · [ ] Retirement accounts
• Anything with a stored payment method
• Phone carrier — add a port-out PIN (SIM swapping is a real follow-on attack)
• Password manager
• Social media
• Anywhere you reused the compromised password

IF REMOTE ACCESS WAS GRANTED

• Disconnect from the internet
• Uninstall the remote software
• Have the machine examined, or back up files and reinstall the operating system
• Assume every password stored in the browser was taken
• Assume every already-logged-in session was accessible

IF IDENTITY DOCUMENTS WERE SHARED

• Credit freezes at all three bureaus + specialty agencies
• FTC identity theft report (produces a recovery plan institutions accept)
• IRS identity protection PIN
• Check the Social Security earnings record for employment you did not perform
• Watch for medical claims and unemployment claims filed in your name

THEN CHECK

• Beneficiary designations on every account
• Address of record on every account
• Autopay and stored payment methods
• The state unclaimed property database in your name

Template 10 — Trusted contact and transfer hold request

Ten minutes, no cost, and one of the highest-value preventive steps available.

RE: Trusted contact designation and account protections — Account(s) [____]

To: [Bank / Brokerage]

1. Trusted contact. Please designate the following person as my trusted contact:

Name: [ ] · Relationship: [ ] · Phone: [ ] · Email: [ ] · Address: [ ]

I authorize you to contact this person if you are unable to reach me, if you have concerns about my health or capacity, or if you suspect financial exploitation. I understand this person is not authorized to transact on my accounts.

2. Transfer protections. Please advise what protections you can place on my accounts and implement those available:

• A hold or callback verification for transfers above $______
• Verbal verification required for any new payee
• A waiting period before a first transfer to a new payee
• Dual authorization above a threshold
• Alerts to me and to my trusted contact for transfers above $______
• No wire transfers permitted without in-person appearance (if you never wire)

3. Please confirm in writing what has been implemented.

[Name] · [Account numbers] · [Date]

Template 11 — Family code word agreement

Send this once, to the people who might call you in an emergency. Not in a group chat with people you do not know. Not on social media.

Hi everyone —

Scam calls using cloned voices are now good enough that hearing a familiar voice proves nothing. Someone can take a few seconds of audio from a video online and reproduce it convincingly.

So we're going to have a code word: [word].

The rules:

1. If any of us calls in an emergency asking for money, bail, or urgent help, the other person asks for the code word.
2. If the caller cannot give it, hang up and call the person back on the number you already have.
3. Nobody puts this word in a text thread, an email, or anywhere online. Memorize it.
4. If anyone ever tells you not to tell the rest of the family about a money problem — that instruction is the scam. Call one of us.

Also, a general rule that costs nothing: before any of us moves money over $[amount], we call one other person on this list first. No judgment, no lecture. Just a phone call.

Love, [Name]

Template 12 — Adult Protective Services report

REPORT OF SUSPECTED FINANCIAL EXPLOITATION

Vulnerable adult: [Name], age [ ], address [ ], phone [ ] Conditions relevant to vulnerability: [physical or cognitive limitations, isolation, dependence on the suspected person] Suspected person: [Name, relationship, address, contact]

Reporter: [Name, relationship, contact] — [ ] I request anonymity

What I have observed:

Date	Observation
	[Isolation — I have not been permitted to speak with him alone since ____]
	[Unexplained withdrawal of $______ from account ending ____]
	[Deed to the residence transferred to [name] on (date), recorded at (reference)]
	[Beneficiary on [policy/account] changed on (date)]
	[Bills unpaid despite income of $______ per month]
	[A power of attorney executed on (date) naming (name)]

Financial institutions involved: [ ] Documents I have: [account statements, recorded deed, POA copy, correspondence] Others with knowledge: [names and contacts]

What I am asking for: an investigation, an assessment of capacity and safety, and referral to law enforcement if warranted.

[Signature] · [Date] · [Contact]

Template 13 — Demand for accounting from an agent

[Date] · VIA CERTIFIED MAIL

RE: Demand for accounting — Power of Attorney of [Principal], dated [date]

To: [Agent name and address]

You are acting as agent under a durable power of attorney executed by [principal] on [date]. As agent you occupy a fiduciary position and owe duties of loyalty, care, and accounting.

I am [the principal / an interested party as defined by [state] statute / a named successor agent / an heir], and I demand a full accounting of your actions as agent, covering [date] to the present, including:

1. All receipts and disbursements of the principal's funds, itemized by date, amount, payee, and purpose
2. All transfers of the principal's assets, including real property, accounts, vehicles, and personal property
3. All changes to account ownership or beneficiary designations
4. All transactions in which you or a person related to you had any interest — direct or indirect
5. Bank and brokerage statements for all accounts you have controlled
6. Copies of any deeds, transfers, or instruments executed on the principal's behalf
7. All compensation you have taken as agent, and the authority for it

Please respond within thirty (30) days.

An agent's authority is to act for the benefit of the principal. Self-dealing is a breach of fiduciary duty, and where a confidential relationship exists, the burden of justifying transactions rests with the agent.

If a satisfactory accounting is not provided, I will petition the court for an accounting, for your removal, and for return of any property improperly transferred, and will seek all remedies available under [state]'s elder financial exploitation statute, including multiplied damages and attorney's fees.

[Name] · [Relationship] · [Contact] · [Date] cc: [Adult Protective Services] · [Financial institutions]

Template 14 — Recovery scam refusal

Keep this. Victims are re-targeted, frequently by the same organization.

When contacted by anyone offering to recover your money:

Say: "I don't pay fees to recover money. Please send me your company name, physical address, license number, and the state agency that licenses you, in writing."

Then hang up and report the contact to IC3 and the state attorney general.

The rules, without exception:

• Government agencies never charge to recover fraud losses.
• No legitimate recovery service requires an upfront fee, a "release fee," a "tax clearance," a "smart contract fee," or a "wallet reactivation."
• Anyone who contacted YOU claiming to have traced your funds is running the second half of the same operation.
• Verify any lawyer with the state bar. Verify any company with the secretary of state and the state attorney general.
• If a "law enforcement officer" or "agency" contacts you about recovering funds, hang up and call that agency's published main number.

Template 15 — Restitution and claims tracker

Two things people miss:

Register as a victim in any prosecution. That is how you appear in the restitution order — nobody adds you automatically.

A drained retirement account frequently generates a reported distribution, which produces a tax bill on money that is gone. See a tax professional before the filing deadline.

The short version

• Call the fraud department first. Say "recall" for a wire. Get a case number.
• Call the receiving bank too.
• File IC3 within hours — mark it BEC for wire and email fraud.
• Confirm every verbal report in writing, with proof of the date.
• Ask for provisional credit. Get any denial in writing, then escalate.
• Email first in the security sweep — and check the forwarding rules.
• Never pay to recover money.
• Ten minutes now: code word · trusted contact · transfer hold · credit freeze · MFA on email · one person you always call.

Related documents

• Scams, Fraud, and Elder Financial Exploitation
• Recognizing and Responding to a Scam
• Fraud Response and Elder Exploitation Checklist
• Identity Theft and Credit Report Toolkit
• Elder Law Toolkit
• Crime Victim Toolkit
• Timeshare Toolkit

Educational only, not legal advice. Error resolution rights, elder exploitation statutes, and institutional hold authority vary. If money moved today, use Template 1 now.