BEC Response Checklist
A payment went to the wrong account, or a mailbox is sending invoices you did not write. Work through 28 steps in the right order — the bank call first, then the mailbox, the scope, the supplier, the insurer — and keep a record of every reference number.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A response checklist for business email compromise and invoice or payment-redirection fraud. It puts the money first — bank recall, reporting and payment holds — then contains the mailbox, scopes what the attacker saw and sent, verifies with the supplier by phone, notifies the insurer and legal, and hardens the payment process. Sample entries show a supplier-compromise case; replace them with yours.
Your context
1. The money — first hours
If a payment went out, the bank call comes before anything else. Recall chances fall quickly after the first 24 to 72 hours, and every hour counts before that.
Call your bank's fraud line (not your relationship manager's email) and ask them to recall the payment and contact the receiving bankmaterial
For an international transfer, ask whether a recall message has gone to the receiving bank and how you will hear back
Report to the authorities quickly: FBI IC3 in the US, Action Fraud in England, Wales and Northern Ireland (Police Scotland on 101 in Scotland), ReportCyber in Australia, or local police elsewherematerial
Stop further payments to the affected supplier and freeze any pending changes to bank details until verifiedmaterial
Check every payment made to changed bank details in the last 90 days, not just the one that was spotted
2. Contain the mailbox
Find whose mailbox was used — yours, the supplier's, or neither (a lookalike domain) — and lock it down.
Work out where the fraudulent email came from: your own compromised mailbox, the supplier's compromised mailbox, or a lookalike domainmaterial
For any of your own mailboxes involved: reset the password, revoke sessions and tokens, and remove attacker-added MFA methodsmaterial
Export, then remove, inbox rules that move, delete, mark as read or forward mail (often keyed on "invoice", "payment", "bank", the supplier's name)material
Check external forwarding at mailbox level and in transport or mail-flow rules, plus delegates and send-as rightsmaterial
Review OAuth app consents and app passwords on the affected mailboxes
3. Scope
Review sent items and deleted items for the attack window: what the attacker sent, to whom, and what they deleted to hide replies
Use mailbox audit logs to see which messages and attachments the attacker opened or syncedmaterial
Identify every email thread the attacker joined or copied (thread hijacking), including other suppliers and customers
Search for lookalike domains registered around the attack and block them at the mail gateway
Search mail logs for the same lure, sender or link sent to other staff, and for other mailboxes with similar rules
4. Verify and warn
Call the supplier on a number from your own records (a past invoice, the contract), never from the suspicious email, and tell them their mailbox may be compromisedmaterial
If mail went out from your domain, warn affected customers and partners not to act on payment instructions from it without a call
Alert finance, payroll and procurement teams: no bank-detail changes without call-back verification until further notice
5. Report and notify
Notify your insurer in line with the policy's notice conditions; social engineering or funds-transfer fraud cover often has its own conditions and sub-limitsmaterial
Ask legal and privacy whether personal data in the mailbox was accessed and which notification duties applyGDPR Art. 33material
Brief executives and, for a material loss, the audit committee; agree who speaks to the supplier and customers
Keep the evidence pack together: headers, rule exports, audit logs, bank correspondence, reference numbers and a timeline
6. Harden
Require call-back verification on a known number for every new or changed bank detail, and a second approver for payments above a thresholdmaterial
Add a waiting period for first payments to newly changed bank details
Phishing-resistant MFA for finance, payroll and executive mailboxes
Block automatic forwarding to external addresses by default
Publish DMARC at enforcement (p=quarantine or p=reject) for your domains and tag external sendersRFC 7489
Brief accounts-payable staff with this case (anonymised): what the email looked like and what would have stopped it
Affected payments
One row per payment sent to the fraudulent account. Keep the bank's references — the insurer and police will ask for them.
Summary for executives
What this template gives you
- Money first: call your bank's fraud line, ask for a recall and a freeze at the receiving bank, report to the authorities, and hold further payments.
- Then contain the mailbox: find out whose mailbox was used, reset and revoke sessions, export and remove hidden rules, check forwarding, delegates and OAuth apps.
- Scope with sent items, deleted items and mailbox audit logs, and look for hijacked threads and lookalike domains.
- Verify with the supplier on a number from your own records, warn customers if your domain was used, and notify the insurer and legal.
- Free to use and customise in your browser; exporting the record is part of any PlayCISO plan.
Frequently asked questions
What is the first thing to do after paying a fraudulent invoice?
Phone your bank's fraud line and ask them to recall the payment and contact the receiving bank. Do it before investigating the mailbox. Then report to the authorities (IC3 in the US, Action Fraud in England, Wales and Northern Ireland, ReportCyber in Australia, or local police) and give the bank the reference.
Can the money be recovered?
Sometimes. Recovery is most likely when the bank is told within hours and the funds are still in the receiving account. After 24 to 72 hours the money has often been moved on. Treat a recall as a chance, not a guarantee. The BEC Wire Recall Triage tool gives an honest likelihood band and the call list.
Whose mailbox was compromised — ours or the supplier's?
Read the full headers of the fraudulent email. If it passed authentication from the supplier's real domain, the supplier's mailbox is probably compromised. If it came from a lookalike domain, nobody's mailbox needed to be. If it came from your own domain, start with your own mailbox. Often both sides have something to clean up.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.