Practical guidance: if a vendor-payment email sent your money to the wrong account, stop researching the scam and start the recovery calls. The FBI says time is of the essence: contact the originating financial institution immediately, request a recall and any necessary indemnification documents, and file a detailed complaint at IC3.gov as soon as possible regardless of the amount.[2]
Guidance checked: October 2, 2026 at 1:09 p.m. EDT (17:09 UTC). This is practical incident-response guidance, not a promise of recovery or legal advice. Financial institutions have different recall and indemnification procedures, and IC3 decides how complaint information is referred or used.[2][4]
This article starts after the payment was sent
The IT Guys has a separate guide on how to verify payment changes before paying an invoice. This guide covers the different operational phase: the first minutes and hours after a business discovers that an ACH, wire, or other transfer followed fraudulent vendor instructions.
The stakes are real. The FBI’s 2025 Internet Crime Report recorded 24,768 business email compromise complaints and $3,046,598,558 in reported BEC losses.[1] Those are reported figures, not a guarantee that every loss is recoverable or that every incident is captured.
Who should use this—and who should use a different path?
| Situation | Use this response? | First owner |
|---|---|---|
| A wire or ACH went to bank details supplied in a fraudulent vendor email | Yes—act immediately | The employee or owner who can reach the originating bank’s fraud or wire team now |
| The payment is queued but not yet released | Stop it now | The payment approver and bank; use the pre-payment verification guide for the underlying change |
| An unexpected invoice arrived, but no money moved | No transfer recovery yet | Accounts payable; preserve the message and use the pre-payment verification guide |
| A business email account was compromised but no payment was sent | Contain the account | Your Microsoft 365 or Google Workspace administrator and IT response lead |
The first 30 minutes: run two tracks in parallel
Practical guidance: do not make the bank response wait for the email investigation, and do not let the email investigation overwrite the payment evidence. Assign one person to financial recovery and another to evidence and account containment when staffing allows. The FBI’s guidance prioritizes immediate bank and IC3 action, while Microsoft, Google, and CISA separately require account and mail-flow investigation.[2][5][6]
Stop additional payments and transfers
Practical guidance: pause any duplicate, scheduled, split, “correction,” or refund payment connected to the suspect instruction. Do not send a one-dollar test, a second transfer, or a fee to “unlock” the first payment; none of those actions verifies that the destination belongs to the intended vendor.[8]
Call the originating bank’s fraud or wire team
Practical guidance: use a trusted number from the bank’s official site, statement, card, or established banking contact—not a number in the suspicious email.[8] Practical guidance: tell the bank that a transfer was induced by suspected business email compromise, give the exact amount and timestamp, identify the destination account and bank, and request an immediate recall or reversal plus any required Hold Harmless Letter or Letter of Indemnity.[1][4] IC3’s account-takeover guidance says making that request as quickly as possible may reduce or eliminate financial losses.[4]
Record the bank response
Practical guidance: write down the bank case number, representative and department, call time, requested action, transfer identifier, destination bank, amount, and promised follow-up. This creates a reliable handoff record while multiple people are working the incident; it does not prove that a recall succeeded.[2][4]
File at IC3.gov with complete transaction details
The FBI instructs victims to file at IC3.gov as soon as possible regardless of the amount and to include full transaction details.[1][2] IC3 may assist financial institutions and law enforcement with possible freezing or recovery efforts, but it does not promise contact, investigation, or recovery.[2][4]
Preserve the original evidence
IC3’s FAQ says it does not collect complaint evidence or accept attachments, and tells filers to keep all original documents securely in case an agency requests them.[10] Practical guidance: keep the original email and attachments, full headers when available, visible sender and reply-to addresses, invoice, payment authorization, transfer confirmation, bank communications, vendor confirmations, and a simple timeline. Export or copy evidence according to your retention and legal process; do not edit the originals.[4][10]
Verify the legitimate vendor outside the suspect thread
Call the vendor through a number already in your accounting system, signed contract, or trusted contact list. CISA warns that attackers may control a compromised or look-alike account and recommends using a known contact number rather than information in the electronic request.[8] Practical guidance: ask whether the vendor changed payment instructions, whether its mailbox may be compromised, and which legitimate invoices and contacts are affected.[8]
Contain the affected email account
If a real business mailbox may be compromised, have the appropriate administrator revoke sessions, reset credentials, review MFA and recovery methods, inspect connected applications, check forwarding and hidden inbox rules, and review sign-in and message-trace evidence. Microsoft and Google publish separate administrator checklists for these tasks.[5][6]
Do not treat “pending” as “recovered”
Practical guidance: a bank accepting a fraud report, opening a case, or sending a recall request does not establish that funds are frozen or returned.[1] The FBI’s 2025 report says its Recovery Asset Team initiated 3,900 Financial Fraud Kill Chain incidents involving about $1.164 billion in attempted theft and about $679 million frozen—a reported 58% success rate for that process, not a victim-specific promise.[1]
Practical guidance: keep the accounting record open as a disputed or suspected-fraud item until the financial institution confirms the actual disposition in writing. Do not book a recall request as recovered cash.[1]
Build one evidence packet—not five conflicting stories
Practical guidance: use one incident record and give each outside party only the information it needs. This reduces contradictions without exposing unrelated customer, employee, or account data.[3][4]
Practical guidance: collect only the incident facts needed for financial recovery, account containment, and authorized reporting.
Transaction facts
- Originating account and financial institution
- Exact amount, date, time, and transfer type
- Transaction or confirmation identifier
- Destination bank, account, beneficiary, and routing details as shown on the instruction
- Recall, reversal, indemnification, and case numbers
Communication facts
- Original messages, headers, attachments, and thread context
- Sender, reply-to, recipient, subject, and message times
- Legitimate vendor contact and independent confirmation
- Who approved and released the payment
- Known suspicious sign-ins, forwarding, rules, or app access
Mailbox containment without destroying the trail
A password reset is only one part of account recovery. Microsoft lists missing or deleted messages, suspicious signatures, unknown forwarding, and rules that hide mail in folders such as Junk Email or RSS Subscriptions as compromise indicators. Its response includes session revocation, app-password changes, MFA and app review, role review, hidden-rule and forwarding checks, and message trace.[5]
Google Workspace tells administrators to suspend a suspected account, investigate sign-in and email-log activity, inspect forwarding and other malicious settings, reset access, and have the user review recovery information and Gmail settings.[6]
CISA’s current forwarding-rule countermeasure says adversaries may use rules to collect sensitive information or retain visibility after credentials are reset. It recommends recording the forwarding destination, reviewing account activity, and disabling a suspicious rule during investigation before removal. CISA also warns that deleting legitimate rules can disrupt business and that leaving attacker access intact can allow a malicious rule to return.[7]
Practical guidance: contain the account, preserve the suspicious rule and forwarding details in the incident record, then remove unauthorized access under administrator control. Review and retain relevant logs; do not “clean up” the logs themselves.[5][6][7]
Who needs to know?
Practical guidance: notify by role and facts, not by panic. Your bank and IC3 need transaction details; your email administrator needs identity and message evidence; the legitimate vendor needs to know which instructions and addresses were false; management needs exposure and continuity facts.[2][5][6]
Practical guidance: use the right-hand pattern for a concise, privacy-conscious handoff; avoid the unverified and overbroad left-hand pattern.
Bad handoff
- “We were hacked” with no transaction ID
- Five different timelines
- Forwarded screenshots without originals
- Unverified claims about which mailbox failed
- Customer data copied to every recipient
- A recall request described as a successful recovery
Useful handoff
- One timestamped incident record
- Exact transaction and destination details
- Original evidence preserved
- Confirmed facts separated from working hypotheses
- Minimum necessary data shared by role
- Bank, IC3, and email-containment status tracked separately
What not to do
- Do not wait for certainty before calling the bank. The FBI says time is of the essence and instructs victims to request recall and indemnification documents immediately.[2]
- Practical guidance: do not negotiate inside the suspect thread. Use independently verified contacts so the attacker does not control both the fraud and the supposed resolution.[8]
- Practical guidance: do not send more money to prove ownership, reverse the first payment, or pay a recovery fee. Only the verified financial institution should direct the formal recall or reversal process.[2]
- Do not delete the original email, rule, or forwarding destination before preservation. IC3 says to retain original evidence securely, while CISA recommends recording and investigating suspicious forwarding before removal.[7][10]
- Do not assume a password change ends the compromise. Microsoft and Google require broader session, MFA, app, rule, forwarding, sign-in, and mail-flow review.[5][6]
- Practical guidance: do not publish or mass-forward the destination account details. Share sensitive transaction data only with the bank, IC3, law enforcement, counsel, insurer, and other authorized responders who need it.[4]
After the immediate response
Reconcile the accounting records
Practical guidance: track the original transfer, bank recall status, any returned amount, fees, insurance claim, replacement payment, and final vendor balance as separate entries. Do not overwrite the original transaction as though it never occurred.[1]
Find the control failure
Practical guidance: determine whether the incident bypassed a callback, second approval, vendor-master change control, mailbox alert, or payment limit. Avoid blaming the person who reported it; a low-friction reporting culture helps the business act sooner.[8]
Repair the payment-change workflow
CISA recommends verbal verification through a known vendor contact, out-of-band authentication, limited transfer authority, and dual approval for defined higher-risk transfers.[8] The FTC separately recommends clear procedures for approving purchases and invoices from vendors the business actually uses.[9]
Exercise the plan
Practical guidance: run a short tabletop drill: one person discovers a wrong-account payment, another calls the bank, another preserves the message, and a fourth produces the vendor and IC3 evidence packet. Measure whether trusted numbers, account permissions, and required transaction details are available without searching the suspect email.[2][8][10]
Two examples
Hypothetical: fast, organized response
A bookkeeper learns at 10:05 a.m. that yesterday’s vendor instructions were false. By 10:12, the bank has the transaction ID and recall request. A second employee files IC3 with the destination details while IT preserves the message and revokes the affected mailbox sessions. The business records each action separately and waits for actual bank confirmation before describing any money as recovered.
Hypothetical: costly delay
A manager spends the morning arguing with the sender and comparing logos, then calls the vendor after lunch. Only then does the business contact its bank. The email investigation may be useful later, but it displaced the time-sensitive financial-recovery step the FBI puts first.
Frequently asked questions
How quickly should I call the bank?
Immediately after recognizing the fraudulent transfer. The FBI’s current BEC guidance says time is of the essence and instructs victims to request recall and any necessary indemnification documents right away.[2]
Does a recall request mean the money is back?
No. It means a recovery action was requested. Practical guidance: wait for explicit confirmation from the financial institution before treating funds as frozen or returned.[1]
Should I file with IC3 if the amount is small?
Yes. The FBI says to file at IC3.gov as soon as possible regardless of the amount and include complete transaction details.[1][2]
Will IC3 contact me?
Not necessarily. IC3’s complaint terms say contact or investigation is at the discretion of the receiving agency and that the filer may not be contacted.[4]
What if the bank says the transfer is still pending?
Practical guidance: ask the bank to stop, hold, reverse, or recall it under the bank’s own process and obtain a case number. Do not cancel the IC3 or evidence-preservation work until the bank confirms the final disposition.[2][10]
Whose email was compromised—ours or the vendor’s?
It may be either, both, or neither; look-alike domains and spoofing can imitate a legitimate sender without taking over that mailbox. CISA documents both compromised and spoofed-account BEC paths.[8] Preserve evidence and let both organizations investigate their own systems.
Is changing the password enough?
No. Microsoft and Google advise broader recovery work that includes sessions, MFA or recovery methods, connected apps, forwarding, rules, sign-ins, and email logs or message trace.[5][6]
Should we pay the real vendor again?
That depends on the contract, bank outcome, cash position, legal advice, and agreement with the vendor. Practical guidance: do not let a replacement payment outrun independent verification, dual approval, and a written accounting plan.[8]
Print-this action order
Practical guidance: use this sequence as an incident-response checklist, then adapt bank-specific and legal steps with the appropriate professionals.
- Stop related payments.
- Call the originating bank’s fraud or wire team from a trusted number.
- Request recall or reversal and required indemnification documents.
- Record the bank case and transaction details.
- File a complete IC3 complaint immediately.
- Preserve original messages, headers, attachments, payment records, and a timeline.
- Verify the legitimate vendor outside the suspect thread.
- Contain affected email accounts and preserve relevant logs.
- Track bank, IC3, mailbox, vendor, and accounting outcomes separately.
- Repair the payment-change process after the immediate response.
Bank and IC3 sources: FBI IC3 transfer-recovery guidance.[2][3][4] Evidence source: the IC3 complaint FAQ.[10] Account and vendor-verification sources: Microsoft, Google, and CISA guidance.[5][6][8]
Bottom line
Practical guidance: when money followed fraudulent vendor instructions, the first job is not proving how clever the email was—it is activating the bank and IC3 recovery path. Stop additional payments, request recall and indemnification documents, and file complete transaction details.[1][2] Preserve the evidence and contain any affected mailbox in parallel.[5][10] Report only what is confirmed: a case opened is not a freeze, a recall request is not a recovery, and a password change is not a complete email investigation.[1][4][5]
Sources
- FBI Internet Crime Complaint Center: 2025 IC3 Annual Report
- FBI IC3: Business Email Compromise — The $55 Billion Scam
- FBI IC3: Business Email Compromise
- FBI IC3: Account Takeover Fraud
- Microsoft Learn: Respond to a compromised email account in Microsoft 365
- Google Workspace Admin Help: Identify and secure compromised accounts
- CISA: Identify and Remove Suspicious Email Forwarding Rules
- CISA: Business Email Compromise Continues to Swindle and Defraud U.S. Businesses
- FTC: Run a small business? Pay your bills, not scammers
- FBI IC3: Frequently Asked Questions — retaining complaint evidence