Business email compromise: what to do if you paid a fake invoice
A vendor, boss or supplier email turned out to be fake, and money may have been wired. Call your bank immediately to recall the payment, then secure the email account and report the fraud.
Do these 3 things in the next 10 minutes
- Call your bank now to recall or freeze any wire sent to the attacker.
- Reset the mailbox password and sign out all sessions.
- Delete any forwarding rules the attacker added.
Then work through the full plan below.
This is a business incident. Time and paperwork matter: insurers, banks and police will ask for evidence. You can follow the free steps below, or talk to Travis now.
Do right now
· Within minutesChange your work email password immediately and use the admin console (Microsoft 365 / Google Workspace) to sign out of all sessions.
More detail
Why this matters: simply changing the password doesn't kick out an attacker who already has an active session token. In Microsoft 365: Admin → Users → 'Sign out of all sessions'. In Google Workspace: Admin → Users → user → Security → 'Sign out'.
Notify your IT department or managed service provider (MSP) right now so they can check for tenant-wide compromise.
More detail
BEC attackers often pivot from one compromised mailbox to others, set up admin-level forwarding rules, or register OAuth apps. Your IT/MSP can pull audit logs and check for lateral movement.
If a fraudulent wire was paid, call your bank's fraud / wire-recall department immediately — speed determines whether the wire can be recalled.
More detail
US banks can sometimes initiate a SWIFT recall or use the FBI's Financial Fraud Kill Chain if reported within ~72 hours and the amount exceeds $50,000. Every hour matters.
Do today
· Within hoursCheck your mailbox for malicious inbox rules — attackers often forward, delete, or auto-archive emails to hide their tracks.
More detail
In Outlook: File → Manage Rules & Alerts. In Gmail: Settings → Filters and Blocked Addresses. Look for rules that forward to external addresses, mark messages as read, or move bank/finance emails to Trash.
Notify affected clients and vendors out-of-band (phone call, not email) that fraudulent invoices may have been sent in your name.
Do this week
· Within days- 🇺🇸 US
File a report with the FBI's Internet Crime Complaint Center (IC3).
- 🇨🇦 CA
Report to the Canadian Anti-Fraud Centre and the RCMP's National Cybercrime Coordination Centre.
Enforce MFA across every user in your business email tenant — no exceptions, including service accounts where possible.
Ongoing protection
· Build the habitRequire dual-channel verification (phone call to a known number) for any wire-transfer or payment-detail change requested by email.
Review email audit logs and OAuth app grants quarterly.
Related situations
Business Website Hijacked or Defaced
Business website defaced or taken over? Secure hosting and domain logins, restore from backup and close the hole.
Bank or Financial Account Compromised
Unauthorized charges or transfers? Call your bank now, freeze the account and dispute the charges with these steps.
Email or Social Media Hacked
Locked out of email, Facebook or Instagram? Recover the account, lock out the hacker and stop scams sent in your name.
Is this happening at work?
If a business account, company device or customer data is involved, the steps change. Get help built for organizations.