A supplier payment may have gone to a fraudulent account

If a released payment may have reached a fraudulent account, contact the sending bank immediately and request its fraud-response and recovery process. Provide the payment reference, amount, currency, beneficiary and time sent. The FBI advises requesting a recall and filing an IC3 complaint promptly. Recovery is uncertain, so keep the request and confirmed outcome separate.

Tell the authorized finance lead and security contact at once. Prevent additional payments to the suspect details while the facts are checked. If an instruction has not yet been released, ask the bank to confirm whether it can be stopped. Do not rely on a portal label without verifying the actual status.

Retain the original emails, attachments, payment instructions, approval records and bank confirmations. Ask the security team to preserve relevant message and access logs using the company's incident process. Screenshots can help explain what staff saw, but they should not replace original electronic records where those are available.

Record a timeline with dates and time zones: when the instructions arrived, who verified them, who approved the payment and when the bank accepted it. Keep established facts separate from assumptions about how the attack occurred. Avoid deleting suspicious messages after forwarding them to the incident owner.

Contact the supplier using a trusted number from before the incident. Confirm whether it changed its payment details, whether it received the funds and which invoices remain unpaid. A reply within the compromised email thread may reach the attacker. The FBI's prevention guidance specifically recommends secondary-channel verification of account changes.

Coordinate any communication about overdue balances with the commercial and legal owners. A fraudulent diversion can leave both a potential loss and an unsettled supplier obligation. Do not assure the supplier that the debt is discharged or promise reimbursement before the facts and contractual position are reviewed.

Maintain one incident register covering the bank case, reporting references, amounts requested for recovery and amounts actually returned. Record who is following up and the next expected response. A bank's acceptance of a recall request does not establish that the receiving institution has frozen or returned the funds.

Ask the accountant to assess the payment, outstanding payable and any loss or recovery claim under the applicable reporting framework. Keep insurance notifications and legal claims with their supporting documents. Do not book an expected insurance payment or bank recovery as certain cash merely because a claim was submitted.

Reconcile any partial return to the original incident and distinguish principal, fees and currency effects. Preserve the gross history so management can see the original exposure and the amount recovered without inferring it from a net journal.

The incident review should identify how unverified details reached the released instruction. Examine vendor-master changes, independent callbacks, approval evidence and access logs. Restore secure credentials and permissions through the bank and security team's approved process if compromise is suspected.

Before resuming the supplier payment, verify the destination again and obtain a fresh authorization. Review other payments that used the same changed details or approval path. Keep unresolved recovery work assigned after normal operations restart; the incident is not financially closed until the bank movements, supplier balance and accounting treatment are supported.