What to do if you paid a fake invoice

Right away

1. Call your bank’s fraud line now. Tell them it is a fraudulent wire or transfer and ask them to request a recall from the receiving bank. Speed matters: money that has not yet been moved on can sometimes be frozen.
2. Report it to the FBI at the Internet Crime Complaint Center (ic3.gov). Reports help the authorities work with banks to freeze funds.
3. Call the real vendor on a number you already have, to confirm what happened and warn them. Their mailbox may be the one that was compromised.
4. Call your IT team. If the fake invoice came through your own mailbox, or someone in your business signed in to a fake page, the attackers may still have access.

Within the day

• Change passwords and sign out every session for any account that may be involved.
• Check mailboxes for forwarding and inbox rules nobody created.
• Keep every email, invoice and bank record. Do not delete anything.
• Tell your insurer, if you have coverage that may apply.

Afterward

Put a rule in place: no change to payment details without a phone call to a known number and a second person’s approval. See when a vendor’s bank details suddenly change.