What to Do When a Business Payment Goes to a Fraudster
A supplier payment went to a criminal's account. The steps that matter in the first hours: bank recall, securing email, evidence, reporting and a blame-free review.
It is one of the most stressful moments for any business: a real supplier chases an unpaid invoice you are sure you paid. The bank details were changed, and the money went to a criminal. Here is what to do.
First hours
- Call your bank and ask for an urgent recall of the payment. Provide amount, date, receiving account and reference.
- Secure email: reset passwords, sign out sessions and check forwarding rules on the accounts involved.
- Call the real supplier on a known number to confirm and warn them.
- Keep evidence: emails with headers, invoices, payment records. See evidence to keep.
- Report to the police or national reporting service. See reporting a cyber incident.
In the following days
- Check other pending payments for changed details.
- Tell your insurer if you have cyber or crime cover. See cyber insurance.
- Run a blame-free review. See post-incident review.
- Strengthen controls. See payment verification.
Avoid blame. These frauds are designed to fool careful people. Focus on the process, not the person.
Related: business email compromise. For more, see our guide to business cybersecurity.
Frequently asked questions
How fast do we need to act?
Immediately. The sooner the bank tries to recall the payment, the better the chance before money is moved on.
Who should we call first?
Your bank, then your IT provider or email administrator to secure accounts, then the police or national reporting service.
Should we tell the real supplier?
Yes, by phone. Their email may have been compromised, and they still need paying.
Sources
- Internet Crime Complaint Center, FBI
- Small Business Guide: Response & Recovery, UK National Cyber Security Centre
- APP scams, UK Payment Systems Regulator
