← IncidentReady

Your business wired money to a scammer. The next hour decides how much you get back.

Business email compromise (BEC) recovery for companies with no security team. Minutes matter — work top to bottom.

Right now — the money

1. Call your bank's fraud line immediately and request a recall/SWIFT recall on the transfer. Recovery odds drop steeply after 24–72 hours; same-day calls recover the most.
2. Ask the bank for a "hold harmless" / indemnity recall to the receiving bank — use the words "business email compromise" and "fraudulently induced wire."
3. File at ic3.gov now. The FBI's Recovery Asset Team has a kill-chain process for freezing domestic wires — it works best inside 48 hours. Have: amounts, dates, both banks, account numbers.
4. Call your cyber insurer's hotline — many policies cover social-engineering fraud, and late notice can void the claim.

Next — the break-in (they're probably still in the mailbox)

1. Sweep inbox rules on the finance/exec mailboxes. The #1 BEC artifact is a hidden rule auto-moving or deleting the attacker's thread (look for rules named ".", "..", or filtering the vendor's domain). Microsoft 365: Outlook → Settings → Rules, and admin-side via Exchange admin center. Google: Gmail Settings → Filters.
2. Reset the compromised account's password AND revoke all active sessions (M365: Entra admin → user → Revoke sessions. Google: Admin console → user → Sign out).
3. Check sent items and deleted items for the real correspondence with the scammer — that's your evidence; export it, don't purge it.
4. Warn the counterparty whose invoice/identity was impersonated — from the phone, not the compromised email thread.

What not to do

• Don't keep negotiating in the same email thread — you're talking to the attacker.
• Don't quietly eat the loss without filing IC3 — recovery does happen, but only if you file fast.
• Don't stop at the password reset — without the session revoke + rule sweep, they're still in.

Preparedness templates, not legal advice. © 2026 IncidentReady