Two parallel jobs: chase the money and clean the mailbox the attacker is reading.
What to do
- Call your bank within the hour and request a recall on the wire — get the recall reference
- Notify the supplier: they may also need to clean their own mailbox if the breach was their side
- Remove any unknown forwarding rule, filter or sign-in session on your mailbox
- Reset your email password and revoke OAuth tokens / app passwords
- Report to the police and your insurer — BEC is usually a covered cyber-insurance event
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers