Business Email Compromise and wire fraud
Paid a fraudulent invoice or wire?
Call your bank, then call us.
Business Email Compromise (BEC) is fraud that uses a hacked or impersonated email account to redirect payments or obtain sensitive information. If money may have gone to a fraudster, call your bank’s fraud line first, then call our 24/7 incident line at 1-650-300-7557. ACS Cyber helps you secure the mailbox, find out what the attacker read and sent, and prevent a repeat.
01
Call your bank
Call your bank’s fraud department immediately and ask them to try to recall or freeze the transfer. Use a number from the bank’s website or your card, never one from the email. If you have cyber insurance, call its claims line or breach hotline early too: many policies require prompt notice or approved responders.
02
Call our incident line
We help you contain the account, preserve the record and work out what else the attacker touched, and we can guide you through the steps below.
03
File with the FBI IC3
Report the fraud at ic3.gov promptly, with the transaction details. Prompt reports give banks and law enforcement more chance to act on a transfer.
04
Secure the mailbox
From a clean device, reset the password, sign the account out of all sessions and review its MFA methods. Record malicious inbox rules and forwarding before you remove them.
05
Warn people by phone
Contact affected customers or vendors using phone numbers you already have on file. Assume the attacker can read the compromised mailbox.
- Changed bank details on an invoice
- Urgent payment requests from an executive
- Replies in threads you never sent
- New inbox rules or forwarding
- Direct-deposit change requests
Not a client yet? You can still call. No one can promise that funds will be recovered, but acting promptly protects your options.
First steps
Do this now, and what to avoid
Protect the money first, then the mailbox. If your bank, our team or your counsel advises differently, follow their direction. Our first-hour BEC guide covers each step in more detail.
| Do this now | Avoid this |
|---|---|
| Call your bank’s fraud line and request a recall | Waiting to finish an internal review before calling the bank |
| File a complaint with the FBI IC3 | Sending further payments to the new account details, or contacting the fraudster |
| Reset the password from a clean device and revoke all sessions | Resetting from the affected user’s own computer, which may be compromised |
| Record, then remove, malicious inbox rules, forwarding and app consents | Deleting the mailbox, messages or rules before they are documented |
| Check every MFA method registered on the account | Assuming MFA stopped the attacker |
| Warn customers and vendors by phone, using known numbers | Replying in the suspicious email thread |
Containment and forensics
Investigating Business Email Compromise
First we establish which kind of BEC you are facing. In an account compromise, the attacker signed in to a real mailbox in your organization. In impersonation, they used a lookalike domain or a spoofed display name and never touched your systems. Sometimes the fraud starts in a vendor’s or customer’s compromised mailbox instead of yours. The response is different for each.
Our in-house forensic team reviews mailbox audit logs, sign-in records, inbox rules, forwarding, app consents and message traces in Microsoft 365 or Google Workspace. Where those records are available and retained, they show what the attacker read, sent, changed or downloaded, and whether other accounts were targeted. Evidence is preserved with documented chain of custody. See what a full incident investigation covers.
- How access was gained: phishing, a reused password or a stolen session
- What was read, sent, forwarded or deleted, and over what period
- Which customers, vendors or employees received fraudulent messages
- Whether sensitive data in the mailbox was accessed
- Whether other mailboxes or accounts are affected
Account compromise or impersonation?
If the attacker used a lookalike domain, your mailbox may be untouched, but your customers and vendors still need a warning.
If they signed in to your account, every message and attachment in it may have been exposed. The investigation works out which it was.
Coordination
Your bank, insurer, counsel and reporting
Your bank and law enforcement are the parties who can act on the money. We cannot recover funds ourselves. Our focus is securing your accounts, establishing the facts and giving every other party a clear record.
Cyber policies often treat funds-transfer fraud and social engineering differently from other losses, sometimes with separate limits and conditions. Ask your broker how your policy applies and notify your carrier early. We work alongside insurer-assigned response firms where your policy permits, and coordinate with your insurer and counsel when you authorize it.
If the mailbox held customer, patient or financial information, your counsel may need to assess notification obligations under state breach-notification laws, HIPAA, the FTC Safeguards Rule or your contracts. We provide the evidence of what was accessed. Your counsel provides the legal advice.
Who to contact, in order
- Your bank’s fraud department
- Our 24/7 incident line: 1-650-300-7557
- The FBI Internet Crime Complaint Center (IC3)
- Your cyber insurer or broker
- Your legal counsel
Recovery
Getting back to business safely
Recovery after BEC means restoring trust in your email and your payment process, not just resetting a password. For longer-term hardening and monitoring, see recovery and protection after an attack.
01
Clean up every affected account
We check that attacker access is gone, remove anything left behind and check related accounts and devices.
02
Re-verify payment instructions
Confirm open invoices and recent bank-detail changes with vendors by phone before the next payment run.
03
Communicate with partners
We help you give customers and vendors accurate, factual information about what happened and what to watch for.
04
Watch for a return
Attackers sometimes try again with what they learned. Monitoring sign-ins and mailbox changes helps catch early signs.
Prevention
Make the next payment fraud attempt harder
BEC succeeds when a stolen password or a convincing message is enough to move money. These controls combine technology with simple business process.
Payment verification procedures
Call-back verification on a known number for any new or changed bank details, and dual approval for large payments.
BEC-focused training
Training and simulations on invoice fraud, executive impersonation and urgent payment requests, for finance teams and leaders.
Conditional access and stronger MFA
Sign-in policies and phishing-resistant MFA for finance and admin roles make a stolen password much less useful.
DMARC, SPF and DKIM
Email authentication makes it harder for attackers to send mail as your exact domain. It does not stop lookalike domains, which is why payment verification still matters. Atlantic Computer Systems, our parent company, can set these up as part of its managed cybersecurity services.
Identity and mailbox monitoring
Our in-house SOC watches for risky sign-ins, new forwarding rules and unusual mailbox activity, 24/7.
First-hour BEC guide
Keep our first-hour checklist with your finance and operations teams, so everyone knows the order of steps.
FAQ
Business Email Compromise questions
Call your bank’s fraud department immediately and ask them to recall the payment, then call an incident response team and file a complaint with the FBI’s IC3. Secure the email account involved so the attacker cannot keep using it, and find out how the fraud happened. ACS Cyber’s 24/7 incident line is 1-650-300-7557.
Sometimes, but there is no assurance. Whether funds can be recovered depends largely on how soon your bank and the receiving bank act, so call your bank first. We do not recover funds ourselves; we secure your accounts and establish what happened.
Sign-in records and mailbox audit logs usually show which it is. Sign-ins from unfamiliar locations or devices, or new inbox rules, point to a compromised account. Messages from a lookalike domain point to impersonation. Our investigation works this out from the records.
Yes. File a complaint with the FBI Internet Crime Complaint Center (IC3), especially if money was sent, and include the transaction details you have. Your counsel can advise on any other reporting.
It depends on your policy. Many policies handle funds-transfer fraud and social engineering separately from other cyber coverage, with their own conditions. Ask your broker, and notify your carrier early. Our cyber-insurance readiness guide explains the controls underwriters commonly ask about. Atlantic Computer Systems, our parent company, also summarizes common cyber insurance requirements.
Warn anyone who received fraudulent messages from your account right away, by phone, so they do not pay. Whether you have formal notification obligations is a question for your counsel, based on what data the attacker could access.
24/7 incident line
Dealing with payment fraud right now?
Call your bank first, then call us at 1-650-300-7557. If the incident is over and you want to tighten email and payment controls, book a free 30-minute consultation. For other incidents, see how we help after any compromise.