Whether or not it succeeded.
IF IT FAILED
Record what happened Tell staff what to watch for Check whether anything was compromised Consider whether a control needs strengthening
IF IT SUCCEEDED
Contact your bank immediately. Speed matters for recovery. Report it to the police Tell anyone affected Change credentials that may be involved Document everything
THE SPEED POINT
Recovery of transferred funds is sometimes possible if reported very quickly.
Hours matter.
WHAT TO CHECK AFTERWARDS
Whether email was compromised Whether any account was accessed Whether other attempts are in progress
WHAT TO TELL PEOPLE
Staff, so they recognise it Affected parties Your bank
WHAT NOT TO DO
Hide it out of embarrassment Fail to report it
WHAT TO LEARN
Which control failed, and why.
WHAT TO CHANGE
That control.
