28 August 2026

We have been scammed: the first 24 hours

I have written a lot here about spotting these things coming: the video call that was not him, the supplier's cloned voice, the flawless email with not one typo. What is missing is the part nobody wants to need and plenty of people end up needing: what you do once you realise it has already happened.

And here the difference is not made by how sophisticated the scam was. It is made by the clock. Money from a transfer can be stopped while it is still in transit; a few hours later it has usually hopped to a second account and the trail gets very hard to follow.

First: how you find out

These things rarely arrive with a label on them. The usual signals that something has gone wrong:

• A long-standing supplier chases an invoice you have already paid. Or you made a payment to a new account number that was sent to you by email or messaging app.
• A customer says they paid and nothing has arrived.
• Someone on the team can no longer get into their mail or a business system, or sees active sessions they do not recognise.
• Mail rules appear that move or delete messages on their own — a classic sign of unauthorised access.
• The bank flags a movement nobody in the building recognises.

If you see one, do not wait until you are certain. Act as though it is real; you can always stand it down afterwards.

Hour 0 to 1: stop the bleeding

• Phone the bank, do not email it. Ask explicitly for the transfer to be stopped or recalled. For an international transfer, the term you want is a SWIFT recall. Note the time of the call and the name of the person who took it.
• Change passwords from a different device, not from the one you suspect is compromised. Start with email: whoever controls the mailbox can reset everything else.
• Kill every open session. Every mail provider has a "sign out of all devices" option. While you are in there, turn on two-factor authentication anywhere it is still off.
• Warn the team on a channel other than the one that may be compromised. If email is affected, phone them.

Hour 1 to 4: preserve the evidence

The instinct is to delete the scam email out of sheer anger. Do not: it is your evidence.

Take screenshots with the date visible, and keep the original messages without forwarding them — forwarding strips technical headers that investigators do use. Write down in a single document the destination account, the amounts, the dates and times, the phone numbers, and who authorised each step. Then check whether there are further payments queued to the same account, and stop them.

Hour 4 to 24: report and communicate

• File a police report. In many cases the bank will not process a serious claim without a crime reference number.
• Call your national cybersecurity helpline. In Spain that is INCIBE on 017 — free, open to businesses, and they will give you the concrete technical steps for your case. Most EU countries have an equivalent.
• Confirm the bank claim in writing, even if you have already spoken by phone. Get it on the record.
• Warn the real supplier or customer. If you were the one impersonated, other people on your contact list are receiving the same email right now.
• If personal data is affected — customers, staff — the GDPR gives you 72 hours to notify your supervisory authority. It is a short window, and it starts when you become aware, not when you finish investigating.

A concrete case

An accountancy firm in Terrassa received an email from its IT supplier with a change of bank account and an invoice for €8,400. The email was impeccable: same signature, same tone, same conversation thread. They paid at 10 a.m. on a Thursday.

At 10:40 the office administrator called the supplier about something else and it came up. Immediate call to the bank: €5,900 that had not yet moved was frozen. The rest was gone. Forty minutes was worth almost six thousand euros.

Four things not to do

• Do not reply to the scammer, not to confirm anything and not to threaten. All you confirm is that the account is live.
• Do not pay anyone who promises to "recover" the money. That is the second scam, and it is often run by the same people.
• Do not hide it from the team. A scam nobody talks about gets repeated on the person at the next desk.
• Do not stop at the patch. If they got in once, work out through where.

And the following week

Two simple measures prevent the large majority of these cases. First: no change of bank account details is ever accepted by email — it is verified by calling the number you already had, never the one in the message. Second: two-factor authentication on mail and on anything that moves money.

Neither is a technology project. Both are a rule somebody has to own, which is the part that usually does not happen.

This article is general information, not legal advice. Reporting routes and supervisory authorities vary by country; the ones named here are the Spanish ones. For a specific decision with legal consequences, consult a qualified lawyer.