We had an account takeover where a fraudster transferred funds to an external financial institution. We immediately requested a reversal, but the external financial institution returned it as Non-Sufficient Funds (the fraudster had taken over that account as well, and immediately exited the funds from THAT account). We are operating under the premise that this was an Account Takeover, identity theft and the receiving financial institution has to return the funds back to us, regardless if they are in the account or not. We initiated the reversal within hours after notification from the customer.

What is the best way of presenting this to the external financial institution? Did we use the wrong R code when requesting the reversal?

Nacha rules do not require the RDFI to return funds to you if the money is gone. As ODFI, you are responsibile for losses resulting from fraudulent transactions that you initiate.

there is no such premise, sorry. In fact, if this was done via ACH, you would be the ODFI and you warrant the origination is in compliance with the Nacha Operating Rules, so you would still be on the hook.