How much of the money taken in a fraud is usually recovered?
Usually none of it. In the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations, 56% of victim organizations recovered nothing following the fraud, 29% made a partial recovery and 15% recovered all of their losses (Fig. 67, p. 77). In the United States and Canada the split was 59% nothing, 26% partial and 15% full (Fig. 114, p. 97).
Those proportions are not improving. The same figure was 52% in the Association’s 2022 edition and 57% in its 2024 edition, so across three studies it has moved within a few points and never toward recovery. Read the numbers for what they are. The 2026 edition rests on 2,402 usable responses out of 10,276 received, each describing the single largest occupational fraud case that a Certified Fraud Examiner investigated between January 2024 and September 2025, in an investigation that was complete and in which the respondent was reasonably sure the perpetrator or perpetrators had been identified (p. 79). That is not a random sample of all occupational fraud. It is weighted toward large matters somebody was paid to investigate and carry to a conclusion — which if anything makes the recovery picture flattering rather than harsh.
The survey also does not say where a recovery came from. A partial recovery in these figures may be a fidelity insurance payment, a settlement with the individual, a clawback from a third party, or restitution actually collected. Those are different mechanisms running on different records and different rulebooks, which is why the aggregate is a starting point for calibrating expectations rather than a forecast for any particular matter.
Why is so little of the money recoverable?
Because by the time a scheme surfaces the money has usually been spent, and the legal claim to whatever remains has already been capped by the low point the account reached in the meantime. Those are two separate problems, and only the first is intuitive.
On timing, the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations puts the median duration of a scheme at 12 months before detection (p. 18), and reports that frauds caught within the first six months carried a median loss of $40,000 while the 5% that ran longer than five years carried a median loss of $1,115,000 (Fig. 7, p. 17). Duration is not only a loss multiplier. It is also the period over which funds are converted into consumption, into assets held by third parties, and into balances that no longer exist in any account a court can reach.
The second problem is doctrinal, and it is the one that surprises people. Where misappropriated or trust funds have been commingled, courts commonly apply the lowest intermediate balance rule: the claimant’s traceable interest is capped at the lowest balance the account reached after the tainted deposit. As the Third Circuit put it in In re Columbia Gas Systems Inc., 997 F.2d 1039, 1063 (3d Cir. 1993), “Once trust money is removed, however, it is not replenished by subsequent deposits.” The Fourth Circuit was blunter in In re Dameron, 155 F.3d 718, 724 (4th Cir. 1998): “In no case is the trust permitted to be replenished by deposits made subsequent to the lowest intermediate balance,” and where the account is depleted entirely, “the trust is considered lost.” Millions passing through afterward do not bring the claim back.
The lowest intermediate balance rule is not the only convention, and which one applies is a legal question rather than an accounting preference. Courts also apply pro rata allocation, first-in-first-out and last-in-first-out. The Tenth Circuit’s formulation in United States v. Henshaw, 388 F.3d 738 (10th Cir. 2004) is the one worth carrying: there are “several alternative methods, none of which is optimal for all commingling cases; courts exercise case-specific judgment to select the method best suited to achieve a fair and equitable result on the facts before them.” The court upheld the government’s use of last-in-first-out there while accepting that the government had alternative approaches available, “each better suited to a different source of funds commingled” in the same account. Applied to identical records the conventions produce materially different traceable amounts. That is precisely why the choice is contested, and why the reason for it has to be documented rather than defaulted to.
If we win the lawsuit, does that mean we get the money back?
No. A money judgment is a right to collect rather than a collection, and the tool that would ordinarily secure the money in the meantime is generally unavailable for a claim in damages. In Grupo Mexicano de Desarrollo, S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308 (1999), the Supreme Court held that a federal district court has no authority to issue a preliminary injunction preventing a defendant from disposing of assets pending adjudication of a contract claim for money damages, where the plaintiff claims no lien or equitable interest in those assets.
The path around that bar runs through equity, and it runs through the records. Where money or property belonging in good conscience to the plaintiff can be traced to particular funds or property in the defendant’s hands, the plaintiff may seek restitution in equity — typically a constructive trust or an equitable lien. Great-West Life & Annuity Ins. Co. v. Knudson, 534 U.S. 204, 213 (2002). The Second Circuit applied that line in Leadenhall Capital Partners LLP v. Advantage Capital Holdings LLC, 171 F.4th 155 (2d Cir. 2026), vacating a freeze on unsecured guarantors’ assets because the lender held neither a lien on nor an equitable interest in them.
Trace first, freeze second, and both before the account runs down — that sequence is the commercial reason this analysis gets bought at all. It is also why months of delay cost more in these matters than in ordinary commercial litigation: the remedy depends on property still being identifiable, and identifiability is what erodes. An injunction is not the only prejudgment tool. Prejudgment attachment under Federal Rule of Civil Procedure 64 and state law is a separate route that turns on statutory findings rather than on tracing, and it is worth a lawyer’s attention early for exactly that reason.
Does a criminal restitution order get the money back?
An order is not a payment, and most federal criminal restitution is never collected. The Government Accountability Office reported that at the end of fiscal year 2016, $110 billion in previously ordered restitution remained outstanding, and that United States Attorneys’ Offices had identified $100 billion of that outstanding debt as uncollectible because of offenders’ inability to pay. Federal Criminal Restitution: Most Debt Is Outstanding and Oversight of Collections Could Be Improved, GAO-18-203 (February 2018).
The same report puts the collection side in proportion. Courts ordered $33.9 billion in restitution against federal offenders sentenced in fiscal years 2014 through 2016, and United States Attorneys’ Offices collected $2.95 billion in restitution debt across those three years, against a stock of debt accumulated over many more. Those figures carry a fiscal year 2016 vintage on their face and should be read that way — the Government Accountability Office’s 2020 follow-up examined how the Department of Justice handled the recommendations rather than restating the balances — but they remain the numbers current commentary works from, including the National Association of Criminal Defense Lawyers’ September 2025 report on federal restitution law, which cites the same study.
Two further points bear on an organization weighing the criminal route. First, the loss figure a sentencing court works from is a legal-definitional construct: loss under USSG § 2B1.1 and restitution are definitions applied to records rather than economic measures of harm, so a large ordered figure is not evidence that a large sum is available to pay it. Second, the criminal route is being taken less often. In the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations, 54% of cases were referred to law enforcement (Fig. 64, p. 75), which the Association records as an all-time low, down from 69% over the last ten editions of the study (p. 76). Among organizations that did not refer, the most common reasons given were that internal discipline was deemed sufficient punishment (51%), fear of bad publicity (35%) and a private settlement having been reached (20%) (Fig. 66, p. 76).
If there were many victims and the money cannot be traced, how is what is recovered divided?
By a distribution method the court adopts, and the method changes who is paid. When tracing fails in a multi-victim scheme, the question stops being whose dollar it was and becomes how an existing pot is apportioned. The two common answers are not equivalent. Under a net investment or pro rata approach, an allowed claim is cash in less cash out and distributions are made rateably against those claims. Under rising tide, a claimant’s prior withdrawals count as part of what they have already received and are set against their share, so claimants who took out more than the eventual percentage receive nothing further. In SEC v. Huber, 702 F.3d 903 (7th Cir. 2012), the Seventh Circuit affirmed a district court’s approval of a receiver’s use of rising tide, treating the choice among allocation methods as a matter within the district court’s discretion.
Before there is a fund to divide there is the question of what can be brought back, and the office bringing it matters. A bankruptcy trustee pursues transfers under the Bankruptcy Code’s fraudulent transfer provision, 11 U.S.C. § 548, and through § 544(b) under state fraudulent transfer statutes that offer a longer reach-back. An equity receiver works outside bankruptcy and relies on the state statutes and equitable claims. An examiner under § 1106(b) investigates and reports rather than recovers. Investors who took out more than they put in are a recognized target of those actions, which is why “we already got our money back” is not a settled position in a multi-victim matter.
One correction is worth carrying, because firm publications and at least one Law360 article by a major-firm practice chair repeat the error. Cunningham v. Brown, 265 U.S. 1 (1924) did not establish the lowest intermediate balance rule. The opinion never states it. It found the money impossible to trace on those facts and declined to extend the analogous trust presumption, observing that to apply it there “would be running the fiction of Knatchbull v. Hallett into the ground.” What the case does supply is the principle the Court actually rested on — “equality is equity” — and so equality of distribution among the victims of a mature scheme, which is a more useful proposition in this context anyway, and close to the opposite of what the case is usually cited for.
Can anyone tell us in advance how much we will get back?
No, and a firm that offers a figure at the scoping call is selling something. The same discipline runs through the rest of the engagement: AICPA Statement on Standards for Forensic Services No. 1 reserves the ultimate conclusion of fraud to the trier of fact and prohibits a member performing forensic services from opining on it, while expressly permitting opinions on whether evidence is consistent with certain elements. An expert who will promise a recovery figure at the outset is not the expert you want holding the other line either.
What can honestly be described in advance is where traces stop, because the stopping points are structural rather than a matter of effort or budget. Five recur. The lowest intermediate balance rule caps what remains identifiable in a commingled account. Bank Secrecy Act records generally need only be kept five years — 31 CFR § 1010.430(d) provides that records required to be retained under that chapter “shall be retained for a period of five years” — which is a practical floor on how far back a scheme can be reconstructed, though many institutions keep records longer. Mutual legal assistance treaties run government to government and are unavailable to private civil litigants, leaving letters rogatory and 28 U.S.C. § 1782. Correspondent “cover payments” historically hid the underlying parties from the banks in the middle: a bank-to-bank MT202 identifies the institutions in the chain but carries no fields for the underlying originator or beneficiary, and while SWIFT’s MT202COV, effective 21 November 2009 and replaced by the pacs.009 COV at the November 2025 end of MT and ISO 20022 coexistence, added mandatory fields replicating that detail, the plain bank-to-bank message remained available and mandatory fields can be filled with placeholder text — the problem moved from a missing field to a field with nothing useful in it. And Suspicious Activity Reports carry an unwaivable privilege under 31 U.S.C. § 5318(g)(2): a subpoenaed institution must decline to produce one and must not confirm one exists, though the underlying transaction records remain producible.
What does move the number is unglamorous and mostly early. Obtaining complete bank records rather than statements, because a statement shows an amount and a date but not a source — the deposit item, the instrument actually deposited, is what establishes where money came from. Identifying a solvent third party, which in a great many employee-dishonesty matters is a fidelity or employee dishonesty policy rather than the individual; those policies typically require a dishonest act committed with manifest intent and cover direct loss, meaning an actual depletion of funds rather than a bookkeeping figure, so the claim is decided item by item against records nobody kept for that purpose. And starting while there is still an account to look at. One statutory shortcut runs the other way and belongs to the government alone: 18 U.S.C. § 984 lets the United States forfeit identical fungible property found in the same account without tracing at all, but only where the action is brought within one year of the offense.
One boundary, stated plainly, because it changes what all of these numbers mean. Identifying what is still reachable, dividing a recovered fund among claimants and proving direct depletion under a policy are operations on records that exist. What the organization lost in consequence — the disruption, the profits foregone, the cost of the response — requires assuming a world in which the conduct never happened, and that is a damages question, covered by our Economic Damages Institute. The division is by question rather than by profession. Forensic accountants do damages work, the AICPA’s Certified in Financial Forensics and NACVA’s Master Analyst in Financial Forensics bodies of knowledge both include it, and the same practitioner frequently writes both reports in one matter.