Toolkit · Banking

The Payment Dispute, Wire Recall, and Fraud Recovery Toolkit

15 U.S.C. § 1693

Type
Toolkit
Jurisdiction
National
Date
2026-03-18
Topic
Banking

This toolkit supplies the working documents for a payment fraud matter. Tool 1 is a rail classification worksheet that determines which law applies before anything else happens. Tool 2 is a first-hour response script with the calls to make and the language to use. Tool 3 is a set of model letters: notice of unauthorized transfer, provisional credit demand, wire recall, freeze request, and preservation. Tool 4 is a chargeback evidence package outline. Tool 5 is a security procedure review worksheet for commercial accounts. Tool 6 is a vendor payment change control protocol. Tool 7 is an incident timeline and evidence index. Tool 8 is a claim evaluation matrix by theory and defendant, and Tool 9 is a consolidated authority table.

The Payment Dispute, Wire Recall, and Fraud Recovery Toolkit

Banking > Payments, Unauthorized Transfers, and Payment Fraud | Published 18 March 2026 - Updated 16 August 2026 | UpLaw - uplaw.us

How to use this toolkit. Work Tool 1 first; it determines which of the remaining tools apply. Bracketed text is for completion. The guide supplies the doctrine and the checklist supplies the sequence.

TOOL 1 — RAIL CLASSIFICATION WORKSHEET

Matter: [client] · Date of loss: [date] · Amount: [$]

1. Rail. [Credit card / debit card / ACH debit / ACH credit / wire / check / instant payment / P2P app]. Source of this answer: [statement line, transaction record, bank confirmation].

2. Account type. [Consumer asset / consumer credit / business / trust or escrow].

3. Who initiated the transfer? [Account holder / third party without authority / account holder while deceived by a third party].

4. Governing law. [EFTA and Regulation E / TILA and Regulation Z plus network rules / UCC Article 4A / UCC Articles 3 and 4 plus Regulation CC / account agreement only].

5. Statement date showing the first affected transaction: [date]. Sixty-day deadline: [date].

6. Where are the funds now? [Still at receiving institution / withdrawn / converted / unknown].

7. Realistic recovery path. [Provisional credit and error resolution / chargeback / recall and freeze / warranty claim / civil action against recipients / none].

📌 If box 3 says the account holder initiated the transfer while deceived, say so out loud at intake. The strategy is entirely different, and the client needs to hear it from counsel rather than from a denial letter.

TOOL 2 — FIRST-HOUR RESPONSE SCRIPT

Call 1 — the sending institution's fraud line.

"I am calling to report [unauthorized transfers / a fraudulently induced transfer] on account [____]. I need three things on this call: a case number, confirmation that a [recall request / chargeback / ACH return] has been initiated, and the name of the representative I am speaking with. I am also giving oral notice of an error under the electronic fund transfer error resolution rules, and I will follow with written notice today."

Call 2 — the receiving institution, if identifiable.

"Funds credited to account [] on [date] in the amount of [$] are the proceeds of fraud. I am requesting an immediate hold on those funds pending investigation. I can provide a sworn fraud affidavit and a police report number within the hour. Please provide a reference number for this request and the name of the department handling it."

Call 3 — law enforcement.

Local report for the file and the report number; federal complaint through the channel able to trigger a rapid freeze on fraudulent wires. File within hours, not days.

Immediately after the calls

☐ Send the written notice and the recall request by email and confirm receipt. ☐ Change credentials; check for mail forwarding, added recipients, and phone porting. ☐ Send preservation letters to every institution in the chain. ☐ Start the incident timeline in Tool 7.

TOOL 3 — MODEL LETTERS

A. Notice of unauthorized electronic fund transfer

To: [Institution], Dispute Resolution · Re: Account [] · Date: []

I am writing to give notice of an error under 15 U.S.C. § 1693f and 12 C.F.R. Part 1005. The following transfers were not authorized by me, and no person had authority to initiate them: [table of date, amount, channel, payee].

I request that you investigate and correct the error. If your investigation will exceed ten business days, I demand provisional credit to my account as required. I further request copies of all documents you rely on in reaching any determination, and written notice of your determination with the reasons stated. Please confirm receipt of this notice in writing today.

[Signature; account holder; contact; case number if assigned]

B. Demand for provisional credit

More than ten business days have elapsed since my notice of [date] and I have received neither a final determination nor provisional credit. The obligation to provisionally credit is independent of the outcome of your investigation. Please credit the account today and confirm in writing. [Reserve all rights, including statutory damages and fees under 15 U.S.C. § 1693m.]

C. Wire recall request

Please issue an immediate recall for the following payment order: date [], amount [$], originator [], originating account [], beneficiary [], beneficiary account [], beneficiary bank [], reference []. The order was induced by fraud. Please provide the reference number of the recall message, confirm transmission time, and request that the beneficiary bank place a hold on the funds pending investigation.

D. Freeze request to a receiving institution

A credit posted to account [] on [date] in the amount of [$] represents the proceeds of a fraud committed against my client. A sworn affidavit and police report number [____] are attached. We request an immediate hold, a review of outgoing transfers from that account since [date], and preservation of all records relating to the account and its opening.

E. Preservation letter

Please preserve, and suspend any automated deletion of, the following for account(s) [] for the period [] to [____]: transaction records; authentication, device, and IP logs; call recordings and chat transcripts; fraud monitoring alerts and their dispositions; the complete dispute file including investigator notes; account opening records; and internal communications concerning this claim. This letter is notice for spoliation purposes.

TOOL 4 — CHARGEBACK EVIDENCE PACKAGE

For the cardholder

☐ Statement page showing the disputed charge, with the transaction highlighted ☐ Written dispute sent within sixty days of the statement, citing 15 U.S.C. § 1666 ☐ Evidence of the good-faith attempt to resolve with the merchant, if asserting claims and defenses under 15 U.S.C. § 1666i ☐ Order confirmations, delivery records, and communications with the merchant ☐ Statement of what was ordered, what arrived, and how they differ ☐ Police report where the charge was unauthorized

For the merchant responding

☐ Authorization records including approval code and authentication result ☐ Delivery confirmation with signature or tracking to the cardholder's verified address ☐ Terms of sale accepted, with the timestamp and the version presented ☐ Prior transaction history with the same cardholder ☐ Communications showing the goods or services were provided as described ☐ Refund or cancellation policy as displayed at checkout

⚠️ Track the network's deadlines separately from the statutory ones. They differ, and losing one does not lose the other.

TOOL 5 — SECURITY PROCEDURE REVIEW (COMMERCIAL ACCOUNTS)

Account: [] · Institution: [] · Agreement dated: [____]

Element Agreed procedure Actually used Gap
Authentication method [token / password / certificate] [ ] [ ]
Dual authorization threshold [$____] [ ] [ ]
Callback verification [required above $____ / not required] [ ] [ ]
Callback number source [file number only / number in request] [ ] [ ]
IP or device restriction [ ] [ ] [ ]
Daily limits [$____] [ ] [ ]
Out-of-pattern review [ ] [ ] [ ]
Procedures declined in writing [list] — [High risk if any]

☐ Confirm commercial reasonableness against the customer's volume, transaction size, and the alternatives offered. ☐ Confirm the institution follows its own procedure, and obtain the evidence of compliance for the disputed order. ☐ Confirm good faith in accepting an order materially out of pattern. ☐ Re-negotiate annually, and never decline an offered procedure in writing without documenting the reason.

📌 In a commercial wire dispute, this worksheet is the case. Article 4A shifts the loss to the customer only where the agreed procedure was commercially reasonable and the bank complied with it in good faith.

TOOL 6 — VENDOR PAYMENT CHANGE CONTROL PROTOCOL

Policy — effective [date]

1. No change to bank account details for any payee is effective until verified by outbound voice call to a number already in the vendor master file, never to a number supplied in the change request.

2. The verification call must be made by a person other than the person who received the request.

3. The verifier records: date, time, number called, person spoken to, and the details confirmed. The record is attached to the vendor file.

4. No payment to changed details is released for [72] hours after verification.

5. Any request marked urgent, or accompanied by a reason the change cannot wait, is escalated to [role] before processing. Urgency is a risk indicator, not a reason to hurry.

6. All change requests are retained for [7] years with the verification record.

7. The vendor master file is reviewed [quarterly] for unexplained changes, with the review documented.

☐ Test the protocol annually with a simulated change request. ☐ Train new finance staff on the protocol before granting payment access. ☐ Apply the same rules to payroll direct deposit changes, which are a growing target.

TOOL 7 — INCIDENT TIMELINE AND EVIDENCE INDEX

Date Time Event Source Evidence ref
[ ] [ ] [Fraudulent email received] [Mailbox] [E-001]
[ ] [ ] [Payment released] [Banking portal] [E-002]
[ ] [ ] [Loss discovered] [Vendor call] [E-003]
[ ] [ ] [Notice to bank] [Letter] [E-004]
[ ] [ ] [Recall requested] [Bank confirmation] [E-005]

☐ Evidence index fields: reference, description, source, date obtained, custodian, format, and whether an original exists. ☐ Capture email headers in full, not forwarded copies. ☐ Capture screenshots with visible system clocks. ☐ Log every call with participants, duration, and outcome on the day it occurs.

TOOL 8 — CLAIM EVALUATION MATRIX

Defendant Theory Key element to prove Evidence needed Deadline Strength
Sending institution Error resolution violation No provisional credit within 10 business days Notice date; credit date [1 yr] [ ]
Sending institution Unreasonable investigation Investigation ignored available records Dispute file; fraud alerts [1 yr] [ ]
Sending institution Article 4A non-compliance Bank did not follow agreed procedure Agreement; compliance record [contract] [ ]
Receiving institution Conversion / negligence Account opened or maintained on notice of fraud Onboarding records [state] [ ]
Recipient Money had and received Receipt of identifiable proceeds Tracing [state] [ ]
Counterparty Negligence Compromised systems caused the diversion Forensic report [state] [ ]
Escrow or closing agent Professional negligence Failure to verify wiring instructions File; standard of care [state] [ ]
Insurer Coverage Social engineering endorsement applies Policy; conditions met [policy] [ ]

TOOL 9 — AUTHORITY TABLE

Provision Subject
15 U.S.C. § 1693 Electronic Fund Transfer Act — findings and purpose
15 U.S.C. § 1693a Definitions, including unauthorized transfer
15 U.S.C. § 1693c Terms and conditions disclosure
15 U.S.C. § 1693d Documentation of transfers
15 U.S.C. § 1693e Preauthorized transfers and stop payment
15 U.S.C. § 1693f Error resolution
15 U.S.C. § 1693g Consumer liability
15 U.S.C. § 1693h Institution liability
15 U.S.C. § 1693m Civil liability
15 U.S.C. § 1693r Relation to state law
15 U.S.C. § 1693l-1 Gift cards and stored value
15 U.S.C. § 1693o-2 Debit interchange and routing
15 U.S.C. § 1601 Truth in Lending — purpose
15 U.S.C. § 1602 Definitions
15 U.S.C. § 1643 Liability for unauthorized card use
15 U.S.C. § 1666 Billing error resolution
15 U.S.C. § 1666i Claims and defenses against the issuer
12 U.S.C. § 4001 Funds availability — definitions
12 U.S.C. § 4002 Expedited funds availability schedules
12 U.S.C. § 5002 Check 21 — definitions
12 U.S.C. § 5003 Substitute checks
12 U.S.C. § 5531 Unfair, deceptive, or abusive acts
12 U.S.C. § 5536 Prohibited acts
31 U.S.C. § 5318 Compliance and suspicious activity reporting
31 U.S.C. § 5330 Money services business registration
12 C.F.R. Part 1005 Regulation E
12 C.F.R. Part 1026 Regulation Z
12 C.F.R. Part 229 Regulation CC — funds availability
12 C.F.R. Part 210 Regulation J — Fedwire and collection
12 C.F.R. Part 1030 Regulation DD — truth in savings
31 C.F.R. Part 1010 Bank Secrecy Act general provisions
18 U.S.C. § 1343 Wire fraud
18 U.S.C. § 1344 Bank fraud
18 U.S.C. § 1349 Attempt and conspiracy
18 U.S.C. § 1030 Computer fraud
Loughrin v. United States Bank fraud — no intent to defraud the bank required
Shaw v. United States Scheme to deprive a bank of customer funds
Van Buren v. United States Computer fraud — exceeding authorized access
Kelly v. United States Fraud statutes protect property interests
Ciminelli v. United States Right-to-control theory rejected
Dubin v. United States Aggravated identity theft narrowed
Household Credit Services v. Pfennig Regulation Z interpretation
Ohio v. American Express Two-sided card platform market analysis
American Express v. Italian Colors Arbitration of network disputes

Closing note

Three habits close most payment fraud files well. Classify the rail before doing anything else. Send the written notice, the recall request, and the preservation letter on day one. Build the claim on the institution's process rather than the fraudster's conduct.

And one habit prevents the next matter entirely: verbal callback to a known number before any payment instruction changes. Every other control in this toolkit is a supplement to that one.

TOOL 10 — CONSUMER PREVENTION BRIEFING

One-page briefing for a client after a loss

What happened, in plain terms. [Describe the rail and why recovery is or is not likely, without jargon.]

What we did. [Notice, recall, freeze, reports, preservation — with dates.]

What happens next, and when. [Investigation deadline, provisional credit date, chargeback timeline, expected decision date.]

What you must do now.

  1. Turn on alerts for every transaction on every account, at the lowest threshold available.
  2. Read every statement within ten days of receipt. The sixty-day clock starts at the statement, not at discovery.
  3. Replace text-message authentication with an app or hardware key wherever offered.
  4. Treat every urgent instruction to move money as false until verified by a number you already had.
  5. Never move money to protect it. No institution or agency has ever asked anyone to do that.
  6. Tell us immediately if anything else looks wrong — a new linked account, an unfamiliar login, mail that stops arriving.

What to expect emotionally. [These schemes are engineered by professionals against ordinary people under manufactured time pressure. The people they succeed against include accountants, lawyers, and bank employees. Speed matters; blame does not.]

TOOL 11 — INSTITUTIONAL DISPUTE FILE STANDARD

A defensible dispute file contains, for every claim:

☐ The date and channel of the consumer's notice, and the text of what was reported ☐ The acknowledgment sent, with its date ☐ The provisional credit decision, its date, and the reason if none was given ☐ The investigation record: what records were reviewed, what authentication events were found, what the fraud model showed, and who decided ☐ The written determination, with reasons stated in terms the consumer can evaluate ☐ Proof of delivery of the determination ☐ The documents supplied on request, and the date supplied ☐ Any re-review, and what new information triggered it

⚠️ Every item above is discoverable and every one is examinable. A substantively correct denial documented badly is worse than a close call documented well.

Quality indicators to audit quarterly

☐ Percentage of claims provisionally credited within ten business days ☐ Median days to final determination, by claim type ☐ Percentage of denials overturned on re-review or regulatory complaint ☐ Percentage of determinations that cite specific evidence rather than boilerplate ☐ Volume of claims where the fraud model had flagged the transaction and it was released anyway

Related Documents