Keep the bank reconciliation reliable during a payment-fraud investigation

Record the cash that left or entered the account, even when the underlying transaction is disputed. A suspected fraud does not make the bank movement disappear. Preserve the original reference and connect it to the incident record so the accountant can distinguish cash reconciliation from the separate question of liability or recovery.

Prompt contact with the bank remains essential. The FBI advises immediate recall requests and reporting for suspected business-email-compromise transfers, while recovery depends on the facts and the institutions involved. The reconciliation should reflect confirmed events, with requests and expected recoveries identified separately.

Create a dated schedule of the original payment, subsequent fees, provisional credits, returned funds and replacement payments. Include currency, bank account, reference and evidence status. Reconcile the schedule with the ledger and statements each close. Keep gross movements visible even if a net figure is used in management reporting.

Use separate status labels for a recall requested, funds confirmed frozen, a credit posted and a recovery finalized. Obtain the bank's wording for each event. A frozen amount may still require further steps before it reaches the company, and a provisional credit can remain subject to the bank's decision.

A partial recovery should be applied to the correct incident. If several suspicious payments exist, avoid allocating the first returned amount across them without supporting references. Keep unexplained differences open and request a bank breakdown. Record the currency of a recovery before conversion so the accountant can distinguish recovered principal from exchange movement and associated charges.

The accounting treatment can involve a loss, an outstanding supplier payable, a recoverable amount or another classification depending on the evidence and reporting framework. Ask the accountant to document the conclusion and its assumptions. An insurance submission or legal claim alone does not prove that the full amount will be recovered.

Keep the commercial obligation separate from the fraud incident. A supplier whose invoice was diverted may remain unpaid; a replacement payment may settle that obligation while the recovery claim continues. The same incident can therefore create several related records with different statuses.

Provide legal, bank and insurer correspondence that bears on the assessment through an approved secure channel. Avoid circulating privileged or personal material more widely than necessary. The working paper can reference restricted documents while retaining enough explanation for the authorized reviewer.

Update the cash forecast for actual losses of access and confirmed returned funds. Keep uncertain recoveries in a separately labeled scenario if management needs to consider them. Do not fund a payment run on the assumption that an unconfirmed recall will arrive before the cutoff.

Report the gross amount affected, cash recovered, remaining claim and any legitimate obligations still due. State which balances are provisional and when they will be reviewed again. A single net loss estimate can obscure a near-term cash requirement or a supplier payment that still needs approval.

When the investigation concludes, reconcile the final bank outcome to the movement schedule and the accountant's entries. Retain the evidence and approvals, close temporary accounts appropriately and update unresolved obligations. Continue normal account reconciliations throughout the process so the incident does not create a second problem of incomplete cash records.