Emergency steps · checked 16 October 2026

You paid a fraudster. Do this now.

Speed matters more than anything else. Banks can sometimes stop or recall a payment if they hear quickly; after a few days the money is usually gone.

In the next hour

1. Call your bank's fraud line (the number on your card or the bank's website, not one from an email). Say it's an authorised push payment / business email compromise fraud and ask them to recall the payment and contact the receiving bank. Note the time and the reference they give you.
2. Report it to the authorities:
   • US: file at ic3.gov straight away. For large international wires the FBI may be able to work with banks to freeze funds, but only when it's reported quickly.
   • UK: call your bank and Action Fraud (0300 123 2040, or report online). The 159 service connects you to many UK banks' fraud teams.
   • India: call 1930 and report at cybercrime.gov.in.
   • Elsewhere: your bank and national police fraud unit.
3. Don't pay any more invoices to the new details, and check whether other payments are scheduled to them.

Today

1. Tell the real supplier using contact details you already had. Their email is probably compromised; they may need to warn other customers.
2. Tell your insurer or broker. Many policies have short notice deadlines. Ask what evidence they need.
3. Keep the evidence: the original emails with headers (don't delete them), the invoice, your payment confirmation, call notes, and any record of how the change was verified.
4. Check your own email for forwarding rules or logins you don't recognise, in case your mailbox was the one compromised.

Next time

A call-back on a number you already had, plus a second approval, stops almost every one of these. Here's the procedure, and PayeeGuard can run it for you.

Check a suspicious email free Set up call-backs and approvals