When it happens: the first hour.

The first minutes: your bank first

If you think you have sent money or bank details to a scammer, contact your bank or financial institution immediately. The Australian Cyber Security Centre says they may be able to stop unauthorised transactions. Scamwatch's first steps are the same: contact your bank or card provider straight away and ask them to stop any transactions. The FBI says that for a fraudulent transfer time is of the essence: ask your financial institution to recall the funds.

The FBI's 2025 report gives a sense of why speed matters. In 655 incidents reported by critical-infrastructure organisations, its recovery team was able to freeze about US$146.6 million of US$261.5 million lost, a 56% success rate. That figure is for one group of cases in one country and does not promise that any particular transfer can be recovered. It only shows that fast reporting gives a chance.

Keep the evidence

Write down what happened, when, how you think it happened and what you did to secure the account, and keep a record of every action you take, for the police, your bank and insurers. INCIBE's steps after a voice-clone fraud add: collect the evidence such as call and meeting records and the phone number used, and file a police report with it. In its Teams case it lists the chat message and the email received. The FBI says to include financial details when reporting: date, type of payment, amount, account numbers and the receiving institution.

Our advice: take screenshots before deleting anything, forward the original message to the person handling the incident rather than copying text, and do not "clean up" the mailbox until IT says so.

Secure the accounts

If an email account may be compromised, the Australian Cyber Security Centre lists these steps: change the password, update the recovery details, sign out of all devices, turn on MFA, remove rules or settings you do not recognise, review connected apps and check recent activity. Scamwatch adds: change passwords on all devices and online accounts, such as banking, email and shopping. A Peruvian state bank advises, after a suspicious call, to block your cards, watch your balances and change your card PIN.

Do this from a device you trust. If the device itself may be infected, use another one.

Tell the people who need to know

If your email account is compromised, let your contacts know as soon as possible, including customers, suppliers and colleagues, so they can spot requests for payment, changes to bank details and malicious links. Encourage any customer or supplier who lost money because of the incident to contact their own financial institution immediately. INCIBE also says to warn all employees so they stay alert for a similar call. Once your details are secure, reporting the scam helps stop it and warn others.

Reporting bodies, hotlines and legal duties differ from country to country. Your course adds the ones that apply to you. In any case, tell your manager first and quickly, because someone senior may need to make decisions about customers, insurers and regulators.

Scenario 1: an invoice

On Tuesday Elena realises the $12,400 payment she made on Friday went to the account in the "changed bank details" email. The real supplier has just phoned asking where its money is.

Red flags: The real supplier reports non-payment; The bank details changed by email only; Time has already passed since the payment.

What to do: Phone your bank now, explain it was a fraudulent transfer, and ask for the funds to be recalled. Tell your manager. Keep the emails, the invoice and the payment record. Reset passwords and check mailbox rules. Warn the real supplier and colleagues.

Scenario 2: an email

Tom clicked a link in a "password expires" email and typed his email password into the page. Ten seconds later he realises the address looked odd. He is on his own at the front desk.

Red flags: A link followed and credentials entered; The page address looked wrong afterwards; The attacker may already be signing in.

What to do: Change the password now from a trusted device, sign out of all devices, and make sure MFA is on. Tell IT straight away; do not wait until you are sure. Check for new mailbox rules. Do not feel ashamed: fast reporting is what limits the damage.

Scenario 3: a phone call

Two hours after a call from the "CEO", Marcus is told by the real CEO that she never called. A transfer of $19,500 was made straight after the call. Two other colleagues were also on the call.

Red flags: A payment made straight after a call from a trusted voice; The real person denies making the call; Other staff were on the call and may be next.

What to do: Call the bank immediately to try to stop the transfer. Warn all staff to expect similar calls. Write down the number that called, the time and what was said, and keep any call or meeting records. Escalate to the manager and file the reports your course describes for your country.