First Steps For A Scammed Business

Act on the transfer before anything else

Contact your bank at once to flag the payment and ask about a recall. How a bank recall works explains what is possible and how fast it needs to happen. If the transfer was made recently, call the National Scam Response Centre on 997 as well.

Restrict any linked accounts, cards, or online banking access that may have been exposed, so the same route cannot be used again while you deal with this.

If your company uses more than one bank or account, check whether they share the same login, approval chain, or signatory. A compromised instruction can sometimes affect more than one account at once.

Tell the right people inside the company

Inform whoever controls banking access and any director who needs to sign off on next steps, so the company can act together rather than in pieces. If the scam came through a fake email or invoice, this is often a form of business email compromise.

Avoid assigning blame internally before the facts are clear. Staff who acted on a convincing instruction need to be part of fixing it, not sidelined by it.

Consider informing your company’s auditor or accountant as well, since the payment will need to be reflected accurately in your financial records regardless of how the case is eventually resolved.

Gather records while they are fresh

Collect the email or message that led to the payment, the invoice or instruction used, the transfer confirmation, and any related correspondence. Save these in one place before memories or inboxes get reorganised.

If your systems may have been compromised, note which accounts and devices were involved so this can be checked separately from the payment itself.

Note down which staff member processed the payment and what approval steps were followed at the time. This is not to assign blame, but to understand exactly where the usual checks were bypassed.

Reporting through official channels

File a police report with the Commercial Crime Investigation Department, and keep the report number for your bank and any later dispute. A documented report is often needed before a bank or insurer will take a claim further.

If your company holds cyber fraud or crime insurance, notify your insurer early, since most policies have reporting deadlines that can affect whether a claim is accepted.

What to do next

Once the immediate steps are done, review how the payment was approved so a similar instruction is caught next time. Consider whether the same payment method or approval process is used elsewhere in the business, since a scam that succeeds once is often attempted again through a similar route.

If the amount is significant, an honest view of whether legal action is worth it can help the company decide what is realistic.