Recall a BEC Invoice Payment and Clean the Mailbox

Two parallel jobs: chase the money and clean the mailbox the attacker is reading.

What to do

• Call your bank within the hour and request a recall on the wire — get the recall reference
• Notify the supplier: they may also need to clean their own mailbox if the breach was their side
• Remove any unknown forwarding rule, filter or sign-in session on your mailbox
• Reset your email password and revoke OAuth tokens / app passwords
• Report to the police and your insurer — BEC is usually a covered cyber-insurance event