Recovery is funds you get back after a fraud or loss event, through clawbacks, reversals, disputes won, or restitution. It offsets gross losses to give the net figure that actually hits the profit-and-loss statement, so tracking recovery rate is how you size your true exposure.
What is recovery, in plain English?
Recovery is the money you claw back after a loss has already happened. Fraud hits, you take a gross loss, and then through various channels, reversing a transfer, winning a dispute, clawing back funds from a receiving bank, or collecting court-ordered restitution, you get some of it back. What remains after recoveries is the net loss, and that net figure is what actually lands on the profit-and-loss statement.
The distinction between gross and net matters because they can differ a lot. A team that only tracks gross losses is measuring its worst-case exposure, not its real one. Tracking the recovery rate, the share of losses you get back, is how you size true exposure rather than the headline damage.
In the detection stack recovery sits downstream of everything else. Prevention stops fraud before it happens; recovery is the cleanup that limits the cost of the fraud that got through. It is usually partial and slow, so it softens losses rather than erasing them.
How a recovery unfolds
Recovery is a race against the money moving. The faster you spot the fraud and act, the more you tend to get back.
- Detect — Spot the fraud. The loss is identified, ideally fast, while the funds may still be reachable.
- Act — Freeze and trace. Freeze accounts, flag the receiving side, and attempt to reverse or claw back the transfer.
- Slower rail — Often recoverable. Funds may still be held and clawed back before settlement.
- Instant rail — Often gone. Money moved and cashed out before anyone can freeze it.
- Pursue — Work the channels. Disputes, reversals, inter-bank recovery requests, and, in big cases, restitution are pursued.
- Net out — Book the net loss. Whatever comes back offsets the gross loss; the remainder is the true net loss.
What it looks like in practice
In practice
Two similar fraud losses hit in the same week. The first is caught within hours; the team freezes the receiving account and, because the transfer went over a slower rail that had not fully settled, most of the funds are clawed back. Net loss is small.
The second is nearly identical in size but is not noticed for two days, and the money moved over an instant rail. By the time anyone acts, the funds have been cashed out and are gone. Recovery is close to zero, and almost the entire amount books as net loss. Same fraud, wildly different outcomes, and the difference was detection speed and the rail the money moved on.
Why speed is what makes recovery possible
Recovery is usually partial and slow, and it varies sharply by payment rail and by how fast you spotted the fraud. Money moved over an instant rail is often gone the moment it lands, cashed out before anyone can act. Money moved over a slower rail may still be sitting where you can reach it, held before settlement, waiting to be clawed back. The same fraud can be nearly fully recovered or a near-total loss depending on those two factors.
That is exactly why fast detection and the ability to freeze funds are core to limiting net loss. Prevention is the first line, but when fraud gets through, speed is what turns a gross loss into a recoverable one. A day of delay can be the difference between clawing the money back and writing it off. Recovery rate, tracked by rail and by detection speed, tells you where that window is open and where it has already closed.
What to watch in the data
- Recovery rate by rail. Instant rails recover far less than slower ones; a blended rate hides where the money is genuinely gone.
- Detection-to-action time. The gap between spotting fraud and freezing funds is often the single biggest driver of how much you get back.
- Gross versus net. Reporting only gross losses overstates exposure; only net, after recoveries, reflects true damage.
- Optimistic assumptions. Booking expected recoveries you have not collected yet understates net loss if the clawbacks fall through.
- Slow channels. Restitution and some disputes arrive months later or not at all, so do not count them as reliable near-term offsets.
Quick questions
What is the difference between gross and net loss?
Gross loss is the full amount the fraud cost before anything comes back. Net loss is what remains after recoveries. Net is the figure that hits the profit-and-loss statement and reflects true exposure.
Why does the payment rail matter so much?
Because it sets how long the money is reachable. Funds on an instant rail are often cashed out and gone immediately, while a slower rail may let you freeze and claw back before settlement.
What channels does recovery come through?
Clawbacks and reversals, disputes won, inter-bank recovery requests, and, in larger cases, court-ordered restitution. Most are partial and some are slow, so recovery softens losses rather than erasing them.
Why is detection speed tied to recovery?
Because recovery is a race against the money moving. The faster you spot fraud and freeze funds, the more you can get back. A day of delay can turn a recoverable loss into a write-off.
Should I forecast expected recoveries?
Cautiously. Recovery is uncertain and often slow, so baking optimistic recoveries into forecasts can understate real net loss. Track actual recovery rates rather than assuming them.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.