If a payment has gone to a fraudster, then what do we do in the first hour?

Start

A payment has gone to a fraudster's account

The money was paid on a false bank-detail change, a fake invoice or an urgent request that seemed to come from an executive. Whoever finds the payment reports it to the IT service desk and calls the finance lead at once, because the bank must be called at once. Nobody is blamed for a report made in good faith.

• Then: Call the bank's fraud team and ask for a recall

Step

Call the bank's fraud team and ask for a recall

This comes before everything else. The finance lead calls the bank's fraud line and asks it to recall the payment and contact the receiving bank, giving the date, amount, your account, the receiving account and the reference. Write down the time, the name of the person spoken to and the bank's reference. The pack's default is within 1 hour of finding the payment; a recall works best within hours.

• Then: Stop further payments to the same account

Step

Stop further payments to the same account

Hold any queued payment, lock the supplier or payee record, and check the next payment run for the same bank details. Change nothing back until the correct details have been confirmed by a call-back to a number already on file, with a second person checking.

• Then: Open the case and set severity on the amount

Step

Open the case and set severity on the amount

The incident manager records the time of the first report and of declaration, the category (business email compromise and payment fraud), the amount and the accounts. Severity is judged on the money at stake. In the pack's example, a €84,000 bank-detail change stopped by the call-back was still Severity 3, judged on the amount asked for.

• Then: Does any Severity 1 or 2 row apply, such as €250,000 at stake?

Decision

Does any Severity 1 or 2 row apply, such as €250,000 at stake?

In the pack's defaults, €250,000 to €1,000,000 at stake is Severity 2 and above €1,000,000 is Severity 1. A taken-over finance, executive, payment approver or administrator mailbox is Severity 2 at least, and so are personal data read from the mailbox or customers sent false requests from it. When in doubt, choose the higher level.

• Yes, or not sure: Tell the executive incident lead within the severity's time
• No: Tell the Head of Information Security the same working day

Step

Tell the executive incident lead within the severity's time

For Severity 2, the executive incident lead within 2 hours; for Severity 1, within 30 minutes, with the crisis team convened within 1 hour and the board chair, or equivalent, told within 4 hours. Tell the finance lead at once whenever a payment is involved.

• Then: Did the request come from one of your own mailboxes?

Step

Tell the Head of Information Security the same working day

For Severity 3, the incident manager handles it and tells the Head of Information Security the same working day, with the finance lead told at once. Severity 4 is logged and handled by the IT service desk. Severity is reviewed at every update and rises if the facts change.

• Then: Did the request come from one of your own mailboxes?

Decision

Did the request come from one of your own mailboxes?

Check the sign-in log for the mailbox the request seems to come from. A request from your own address is treated as a takeover of your mailbox until shown otherwise. If it came from a supplier's or customer's real mailbox, nothing of yours may be compromised.

• Yes, or not yet known: Lock the attacker out of the mailbox
• No: someone else's mailbox: Warn the sender by phone and check other requests

Step

Lock the attacker out of the mailbox

Revoke all sessions on the account, reset the password and the second factor, and remove rules, forwarding, delegates and connected applications the user did not set up, photographing them first. A password reset alone is not enough: signed-in sessions and rules survive it. The pack's default is within 30 minutes of declaration, and no approval is needed to lock out an attacker.

• Then: Keep the email, the headers and the payment records

Step

Warn the sender by phone and check other requests

Do not reply in the email thread. Call the supplier or customer on the number already on file, tell them their mailbox appears to be compromised, and follow up in writing to a known contact. Check whether anyone here replied with information or entered a password from the same email chain, and review that sender's other bank-detail changes and invoices.

• Then: Keep the email, the headers and the payment records

Step

Keep the email, the headers and the payment records

Save the fraudulent email as a file or have the email provider export it. Do not forward it: forwarding loses the headers. Keep the payment instruction and approval, the bank's recall reference and all bank correspondence. Export mailbox audit and sign-in logs on the first day, because they are kept only for a limited time.

• Then: Report the crime and start the reporting screen

Step

Report the crime and start the reporting screen

Report the fraud to the police or national fraud reporting service the same day; the bank may ask for the reference. Where you hold a cyber policy, tell the insurer as it requires, since money was lost. Screen every reporting duty within 4 hours of declaration: personal data read from a mailbox, a loss large enough to be a significant incident, or client money for a financial entity.

• Then: Set the next update and keep chasing the recall

Outcome

Set the next update and keep chasing the recall

Updates run every 4 hours at Severity 2 and every 24 hours at Severity 3, each with the bank's answer on the recall. The finance lead and Legal pursue the recall and any insurance claim, which can run on after the case closes. If no call-back was made before the payment, record why and make it a question for the review.