If a compromised email account changed bank details, treat the situation as both a payment incident and an account takeover. The priority is to stop money from moving, contact the right payment provider, and prevent the attacker from continuing to use the account. Do not reply to the suspicious message or use the phone number or link included in it.
Assign clear roles if possible: finance or payroll handles payment contacts, IT secures the email account, and a leader coordinates decisions and records. In a small organization, one person may need to coordinate several of these tasks. Keep a written timeline of actions and contacts.
Act first: stop or trace the payment
If a payment is pending, contact your bank or payment provider immediately. Ask whether it can be stopped, held, or recalled, and follow the provider’s instructions. Use a phone number from an existing statement, verified account portal, or previously saved contact, not one supplied in the suspicious email. A recall is not guaranteed, so speed matters.
If the payment has already gone out, contact the sending bank or provider right away. Explain that the transfer may have been sent to a fraudulent account and ask them to begin their recovery or recall process. Provide the transaction details they request, and ask whether they can contact the receiving institution. Keep a record of the case or reference information they provide.
For a vendor payment, alert the person responsible for accounts payable and the vendor through an established, trusted channel. For payroll, contact the payroll provider and the organization’s payroll or HR contact. If an employee’s direct deposit was redirected, speak with the employee using known contact information and ask the provider what steps are available to stop or correct the deposit. Do not assume that changing the email password will reverse a payment.
Separate payroll diversion from vendor fraud
The details of the payment determine who should be involved:
- Employee direct deposit: Check whether the change was made in the employee’s payroll profile or in the payroll system. Contact the payroll provider and the employee using previously verified contact details.
- Vendor payment: Check whether the vendor’s record was changed in your accounting or payment system. Contact your bank or payment provider and verify the bank change with the vendor through a known phone number or another established channel.
- Company account or payment platform: Ask the bank or provider to review access, recent changes, and pending payments. Secure the relevant user accounts as well as the email account used to approve or request changes.
Do not treat a message inside an existing email conversation as proof that a bank change is genuine. An attacker may be able to read and manipulate that conversation. Confirm the request using contact information your organization already had on file, and require a second approver for changes to payment details.
Secure the compromised email account
Use a trusted device and the organization’s normal account recovery process. If you suspect the device itself may be compromised, contact your IT provider before using it to change credentials.
- Change the account password to a new, unique password. If the same password was used elsewhere, change it on those accounts too.
- Sign out other active sessions and revoke access for devices or applications you do not recognize, using the email provider’s account security settings.
- Review recovery email addresses, phone numbers, and other account recovery options. Remove anything you do not recognize.
- Check for suspicious forwarding, inbox, or filtering rules. Attackers may use them to hide replies, copy messages, or keep track of the account after a password change.
- Review connected applications and delegated access for anything unfamiliar. Ask your IT provider to help investigate if you cannot confirm whether access is legitimate.
- Turn on multifactor authentication if it is not already enabled, and verify that its recovery methods belong to the account holder.
Tell colleagues who might have received suspicious messages not to open attachments, follow links, or act on payment requests from the account until it has been secured. If you need a fuller containment plan, see Zevonix’s guide to email security for businesses.
Preserve evidence and report the incident
Keep relevant evidence before deleting or altering messages. Save suspicious emails in their original form when possible, including full headers, and preserve related messages, account alerts, and payment records. Record the date and time of the suspected account access, the payment amount and recipient details, who was contacted, and what each provider advised. Store the information in a location the compromised account cannot access.
Report business email compromise through the FBI’s Internet Crime Complaint Center. The IC3 also provides guidance on payroll diversion involving stolen employee credentials. Share the information requested in the reporting process and keep a copy of what you submit.
For help organizing next steps after a suspected compromise, Zevonix also outlines incident response for small firms. A documented response plan can help finance, payroll, IT, and leadership coordinate quickly if a payment change turns out to be fraudulent.
Reduce the chance of another payment diversion
Make payment-detail changes harder to approve through email alone. Use a known phone number or another established channel to verify a vendor’s new bank details, and require a second approver before updating payment records. Keep vendor contact information separate from change requests so staff can check it independently.
For payroll, remind employees to report unexpected account-change notices or direct-deposit problems promptly. Limit who can change payroll and payment information, and review access when roles change. Regular security awareness training can help staff recognize urgent or unusual requests without assuming that a familiar email thread is trustworthy.
Conclusion
When an email account changes payroll or vendor bank details, contact the relevant bank or payment provider first, then work with payroll or the vendor through verified channels. Secure the account, preserve evidence, and coordinate responsibilities. If your business needs help preparing an incident response plan, contact Zevonix to discuss its cybersecurity services.