First minutes: contact the bank and verify the request
If money has been sent, contact the originating bank or payment provider immediately through its established fraud channel. Ask whether the transaction can be stopped or recalled and what information its recovery team needs. IC3 specifically recommends contacting the originating financial institution as soon as fraud is recognised. A recall request is an urgent action, not a guarantee that funds will return. [1]
Give finance one owner for the banking response. Prepare the payment reference, amount, currency, execution time, beneficiary details and relevant correspondence. Record whom the team contacted and the reference assigned. Keep follow-up calls moving while technical investigation begins; a completed forensic report is not a prerequisite for asking the bank to act.
Pause related pending payments and verify the genuine instruction using a previously established telephone number. Do not use contact details supplied in the suspicious message. The FBI recommends independently checking payment requests and changes to account information. [2]
Distinguish impersonation from account compromise
Business email compromise describes the fraud, not one technical entry point. A criminal may impersonate a supplier using a similar address, or use a genuinely compromised mailbox and a convincing existing conversation. An authentic-looking thread therefore does not establish that the payment instruction is genuine. [2]
Ask three separate questions: was a company account accessed, was a counterparty account accessed, and did anyone act on the instruction? Keep each answer provisional until evidence supports it. A supplier reporting a fraudulent invoice does not by itself prove that your own email system was breached. Equally, the absence of a completed payment does not close an account-compromise investigation.
Agree which transactions and counterparties need immediate verification. This gives finance a bounded review list instead of an instruction to question every historic payment without a starting point.
First hour: assign decisions and contain access
Appoint an incident lead, a finance contact and a technical lead. Include legal or privacy advisers when confidential information, reporting duties or contractual commitments may be involved. NIST recommends coordinated incident handling, clear ownership and risk-based prioritisation. Keep a concise decision log with an owner and next update time. [5]
Have authorised administrators follow the email provider’s compromised-account procedure from a trusted device. For Microsoft 365, this includes restricting the affected account, revoking sessions and reviewing authentication methods, application consent, assigned roles, forwarding and inbox rules. A password reset alone does not address every route to continued access. Record suspicious settings before removing them where this can be done without delaying urgent containment. [3]
Google Workspace similarly recommends temporarily suspending a suspected compromised account, investigating activity and revoking access. Its checklist also covers recovery details and security settings. Use the procedure for the actual environment rather than assuming Microsoft and Google controls behave identically. Preserve the account’s data; account deletion is not a sensible substitute for restricting access. [4]
First few hours: reconstruct the conversation and exposure
Build a timeline that begins before the first known fraudulent message and continues through containment. Microsoft recommends examining sign-in and audit activity, then reviewing messages sent during the relevant period. Investigate suspicious forwarding and hidden inbox rules, including rules that concealed replies. Do not limit the review to the visible Sent folder. [3]
For Google Workspace, the administrative checklist points to user sign-in events, email delivery searches and relevant OAuth, Drive and administrator activity. This matters because a mailbox may be only one part of the affected account’s access. Confirm which records are actually available to your organisation before promising a complete reconstruction. [4]
Keep original messages, attachments, transaction records and exported logs in a restricted incident collection. Record export times, search ranges and time zones. Ask the affected person what they saw and did, without treating an initial recollection as a complete technical account. Separate confirmed facts, reported observations and working hypotheses in the timeline.
Before the day ends: coordinate reporting and counterparties
Report the suspected fraud through the appropriate local law-enforcement route. In the United States, IC3 provides the FBI reporting channel and requests detailed transaction information. Elsewhere, follow the relevant national process and your bank’s instructions. Reporting and a bank recall serve different purposes; keep a record of both. [1]
Ask legal advisers to assess the facts against applicable obligations and contracts. A universal notification deadline cannot be inferred from the words “email compromise.” NIST places legal and contractual considerations within incident coordination; the correct action depends on the affected information, entities and jurisdiction. [5]
For a counterparty warning, state the known risk, the transaction or message concerned, and a trusted way to verify instructions. Avoid speculation about who was responsible. Agree who can communicate externally so that a supplier does not receive conflicting explanations from finance, IT and account management.
Set explicit conditions for resuming normal work
End the first day with a short status note: payment recovery activity, accounts contained, known exposure, unresolved questions and named next actions. Record whether email access has been restored and who approved it. A working inbox does not answer every question about messages already sent or information already accessed.
Before releasing held payments, finance should independently revalidate beneficiary details and approval authority. Before restoring an affected account, technical staff should complete the provider’s recovery procedure and decide what monitoring will continue. These decisions should be visible to the incident lead rather than assumed from the absence of new alerts.
The first 24 hours are an organising frame, not a promised resolution time. Banking recovery, account investigation and business communication will often continue beyond it. The useful first-day result is a controlled response with clear evidence, fewer opportunities for further loss and an honest account of what remains unknown.
