The FBI’s Recovery Asset Team (RAT) froze $679 million of $1.16 billion in attempted cyber theft in 2025, a 58% success rate. The process requires victims to act fast: call your bank, call your local FBI office, and file a report at IC3.gov, all within 48 hours of discovering fraud. The 2025 Internet Crime Report also shows $20.877 billion in total reported losses, meaning most fraud losses occur in cases that are reported too late or not at all.
On September 29, 2026, the FBI posted a reminder on X about its Recovery Asset Team, known as RAT. The bureau announced that since January 2025, RAT has blocked over $1 billion in attempted theft, up 16% from the same period in 2023 and 2024. The announcement came alongside the release of the FBI’s new cyber strategy for 2026.
What the Recovery Asset Team Actually Does
The FBI created RAT in February 2018 to address a specific problem. By the time a fraud victim contacted the police, the money had already moved several times and was effectively untraceable through standard channels.
The RAT operates through what the FBI calls the Financial Fraud Kill Chain. The process is straightforward, though it depends on speed and complete information.
It starts with a report filed at IC3.gov, the FBI’s Internet Crime Complaint Center. The report must include banking information, specifically the account the money was sent to and the bank name. Without that detail, RAT can’t act.
If the case meets the criteria, RAT contacts a designated representative at the receiving bank and requests an account freeze. At the same time, RAT notifies the relevant FBI field office to coordinate next steps. For international transfers, RAT works with the Financial Crimes Enforcement Network (FinCEN) and the FBI’s Hong Kong office.
The whole system is essentially a relay race between you, your bank, the FBI, and the bank that received the stolen money. The faster the baton moves, the better the outcome.
Why the 48-Hour Window Is Critical
Robert Bohls, who leads the FBI’s Salt Lake City field office, has made this point publicly and directly: many victims give up too quickly. They believe nothing can be done once money has left their account. That belief is wrong, but only for a narrow window of time.
His recommended sequence: call your bank immediately, ask them to recall the funds, call your local FBI office, and then file a report at IC3.gov. Everything within 48 hours. After that, the probability of recovery drops significantly, not because the FBI stops trying, but because money in motion moves fast. Once it’s been withdrawn as cash, converted to cryptocurrency, or passed through multiple accounts, the chain becomes very difficult to break.
Two real cases illustrate what’s possible when victims act quickly. In a 2019 Colorado case, a victim who reported promptly recovered $54,000, nearly the full stolen amount. In a separate case, victims who wired money to scammers during a home purchase recovered $449,000. Both recoveries depended on speed.
This is the same dynamic we’ve seen in how cyber fraud laundering works through cryptocurrency and underground markets: the longer money stays in the system before recovery action begins, the more layers it passes through and the harder it becomes to trace.
The Success Rate Is Falling – Here’s Why
The 58% recovery rate in 2025 is meaningful. It’s also lower than it used to be.
In 2021, RAT froze more than $328 million of $443 million in attempted theft, a 74% success rate. It processed 1,726 incidents that year. By 2025, the workload had more than doubled to nearly 3,900 incidents, and the recovery rate had dropped 16 percentage points.
The reasons aren’t mysterious. Fraud operations have become more sophisticated. Money is moving faster, through more accounts, with cryptocurrency conversion happening within minutes of transfer. Fraudsters’ growing use of AI, including AI-powered social engineering that makes scam calls and emails more convincing, has increased the number of victims who don’t realize they’ve been defrauded until well after the 48-hour window has closed.
Healthcare cases are notably different. RAT achieves a 65% recovery rate in healthcare fraud, likely because healthcare organizations tend to have compliance teams and banking relationships that enable faster, more coordinated response.
The Bigger Picture: $20 Billion Lost, $679 Million Recovered
The $679 million RAT frozen in 2025 is a real achievement. It’s also 3.3% of the $20.877 billion in total losses the FBI logged that year.
That context matters. The bureau received 1,008,597 complaints in 2025, up 26% in total reported losses from the year before. People aged 60 and older filed 201,266 of those complaints and reported $7.7 billion in losses, the largest single demographic hit by online fraud. Business Email Compromise scams, where criminals impersonate vendors, executives, or partners to redirect payments, cost victims $3.046 billion.
The vast majority of money lost to cyber fraud isn’t touched by RAT because it’s either reported too late, not reported at all, or involves types of fraud that don’t fit the Financial Fraud Kill Chain model. The $679 million frozen represents cases where victims acted quickly and had the right information. The $20 billion-plus that wasn’t recovered represents everyone else.
Operation Level Up: Catching Active Victims
Alongside the RAT announcement, the FBI highlighted another program that deserves attention: Operation Level Up.
Unlike RAT, which responds to completed fraud, Operation Level Up proactively contacts people who are still in the middle of an active scam. In 2025, the program notified 3,780 victims. Crucially, 78% of those people had no idea they were being scammed at the time.
The program is particularly important for investment fraud and romance scams, where victims are often strung along for months, making regular payments and building an emotional or financial relationship with a criminal operation. Intervention during an active scam is far more effective than recovery after the fact.
The FBI estimates Operation Level Up saved approximately $225 million in 2025, money that was never stolen because someone was stopped before they sent it.
For individuals worried that their data or credentials may already be in criminal hands, which can be the first step toward targeted fraud, our dark web data exposure guide covers the early warning steps that can reduce the risk of becoming a target in the first place.
Watch for Recovery Scams
One fraud category every victim needs to know about is recovery scams. In 2025, the FBI recorded 10,516 complaints involving recovery scams, frauds that target people who have already been scammed.
The pitch is consistent: someone contacts you claiming they can recover your stolen money, but they need an upfront fee first. The fee is stolen. The money is never recovered. In 2025, recovery scams cost victims $1.4 billion.
If anyone contacts you unsolicited claiming they can get your money back, treat it as a scam unless proven otherwise. The real recovery process starts with a report you file yourself, not a call you receive.
As we’ve covered in looking at how extortion campaigns target fraud victims after an initial breach, being victimized once can make people more susceptible to a second attack, and recovery scams are designed to exploit that vulnerability.
What to Do If You’re Defrauded
The FBI’s guidance is clear and has a specific order for a reason.
Call your bank first. Don’t email, but call. Tell them you believe you’ve been defrauded and you want the transfer recalled. Ask specifically about their indemnification process and what documentation they need. Every hour matters here.
Call your local FBI field office. The FBI’s website has a locator by city and state.
File a report at IC3.gov. Include the date of the fraud, the amount, the account number the money was sent to, and the receiving bank’s name. Without banking details, RAT cannot initiate the kill chain.
Keep every piece of documentation: emails, text messages, receipts, screenshots, and any contact details you have for whoever you believe defrauded you.
The 2025 data shows that when people act quickly, more than half of the money is recovered. When they don’t, almost none is.
