💸 Business Email Compromise / Wire Fraud

• If a wire transfer was just sent, immediately call your bank and request a recall — speed matters, funds can sometimes be frozen within hours.
• Do not reply to or engage further with the suspicious email thread.
• Change the password on the compromised email account immediately, and enable MFA if it wasn't already on.
• Notify your Incident Lead and anyone else who may have received similar fraudulent requests.

• File a report with the FBI's Internet Crime Complaint Center (IC3.gov) — banks often need this for recovery attempts.
• Review the compromised account for forwarding rules, mailbox delegation, or other signs of ongoing access.
• Check whether other accounts share the same password and change those too.
• Notify your bank's fraud department in writing, and get a case number.

• Review and tighten wire transfer approval processes (e.g. require verbal confirmation via a known phone number for any change to payment instructions).
• Audit email account access logs for the period of compromise.
• Consider notifying vendors/partners who may have received fraudulent emails impersonating your organization.

If the compromised account contained personal or financial data belonging to others, this may trigger breach notification obligations. Consult legal counsel to assess whether notification is required and to whom.