FYI: The (Federal) statute of limitations on fraudulent bank transfers is 5 years. That's from a "they can prosecute you" standpoint. Various states have their own laws but in Florida (where I live) the undo button on the "oops, the bank/some company transferred a million into your account without noticing" is
one year.
There's two reasons why the time frame is so short: 1) "It's their own damned fault." There's an expectation that of all the institutions that should have 100% control and visibility to all of their transactions it's banks and big businesses. 2) The longer funds have gone unreturned the more expensive and time consuming it (usually) is to trace where the money went. I don't know if one year is the optimal period for such tradeoff calculations (probably not) but it is what it is.