Supplier payment fraud: coordinate your response

Run coordinated work alongside the recall

Do not wait for an internal investigation before contacting your bank through its official contact details. Use the bank transfer fraud guide for recall and reporting advice. This guide adds the coordination work: appoint an incident lead, a finance contact, a supplier liaison and a technical contact, with a safe communication channel outside the suspect email thread.

Give the bank the payment confirmation, beneficiary details, transaction reference and fraudulent request. Ask what supporting evidence it needs, who owns the case and how updates will reach you. Record a recall request separately from a confirmed recovery. Keep the bank informed if you discover additional affected transfers.

Verify the supplier without using the suspect thread

Call an established supplier contact using details held before the suspicious request. Do not use a replacement number, link or contact supplied in that request. Government business guidance recommends phoning a trusted contact rather than verifying by replying to the message. The compromised supplier email guide covers checks before further payment.

Ask whether the supplier issued the request, received the payment or discovered unauthorised mailbox access. Agree a verified channel for incident updates and ask its technical team to preserve relevant evidence. Record who confirmed what and how their identity was checked. A convincing email alone does not establish whose system was compromised.

Preserve originals while the technical team contains access

Keep original emails in their native format with full headers, attachments and the surrounding conversation. Retain invoices, approved bank details, payment approvals and bank confirmations. Screenshots help explain the sequence but should accompany originals. Store a protected evidence copy, record who collected it and when, and use separate working copies.

Ask your technical team to preserve available sign-in logs, mailbox audit records, forwarding rules, delegated access and payment-system change history. Let it capture evidence while promptly restricting suspect access, ending sessions and securing authentication. Do not delay containment to perfect the evidence pack. Record changes made during containment and any evidence already missing.

Have the technical team check both impersonation and account compromise, including lookalike addresses, altered reply addresses and unexpected forwarding. Ask it to establish the affected period and other exposed contacts or invoices. Government technical material supports preserving logs and compromise evidence; these collection steps are a practical checklist, not a statutory procedure.

Hold affected pending payments and control restart

Ask finance to identify queued transfers, scheduled payments and recent beneficiary changes linked to the suspect account, mailbox or supplier. Mark affected items on hold in the payment system, not merely in an email. Ask the bank whether submitted but unsettled transfers can still be stopped, and record its response.

Review other suppliers touched by the same compromised access. Keep unaffected payments distinguishable from suspect items so the hold has a clear scope. Do not resend the lost payment simply because someone supplies different details. Agree the outstanding invoice position through verified contacts, then require finance approval and technical confirmation that the payment workflow is safe before release. See safe supplier payment controls.

Maintain an incident action register

Keep the register in a controlled location accessible through trusted accounts. Record each action, owner, target completion time, status, evidence location and next follow-up. Include bank and reporting case references, verified supplier conversations, payment holds and technical containment. Keep observed facts separate from assumptions.

Review open actions with the incident lead and share only the evidence each recipient needs through an agreed secure channel. Record actual outcomes: a submitted report, an acknowledged bank request, a blocked payment or confirmed recovered funds. Close the incident only after payment reconciliation, restart approval and unresolved risks have named owners.