Your Business Just Got Scammed. Now What? A 2026 Incident Response Playbook
The first phone call is always the same one. A controller, voice flat, asks the bank if the $187,000 wire that left at 3:12 — the one the CFO supposedly approved over text — can come back. By the time they’re asking, the answer is almost always no.
The FBI’s 2025 IC3 report attributes $3.05 billion in losses to business email compromise alone last year across 24,768 incidents — roughly $123,000 per case, with 86% of dollars walking out as a fraudulent wire. BEC is the second-largest fraud category overall, and it almost never hits the businesses you’d expect. The losses cluster at small and mid-market companies with thin AP teams, no formal callback policy, and a CEO who still approves invoices over email.
This is the playbook for the moment you realize it just happened to you.
The first 60 minutes — the wire is everything
If your incident involves money already moving (BEC, vendor-email compromise, payroll diversion, fake-invoice fraud), there is only one priority and it is not technical: get the wire stopped. Everything else — legal, communications, even forensics — runs second to that call.
- Call your bank’s wire-fraud or treasury desk. Not the branch. Use the number on your wire authorization paperwork or your banker’s direct line. Tell them to initiate a wire recall.
- File at ic3.gov in parallel. Have a second person dialing while the controller is on with the bank. The FBI’s Recovery Asset Team needs five fields to run the Financial Fraud Kill Chain: wire amount, send date, receiving bank, receiving account number, and a one-paragraph narrative. Tickets that hit IC3 inside the first 24 hours and meet the dollar threshold get worked the same business day.
- Notify your cyber insurer. Most cyber policies require notice within hours, not days. Late notification is the most common reason claims get denied; missing the window can cost you more than the wire did.
- Preserve evidence before you touch the inbox. Do not delete the spoof email. Do not change forwarding rules. Do not reset the compromised user’s password until the forensics path is captured. The CISA-FBI #StopRansomware Guide details what to grab; the short version: full mailbox export, sign-in logs, mailbox rule history, and an image of any affected endpoint.
One important nuance: BEC is rarely isolated. Roughly half of 2025 BEC incidents involved a real vendor whose email had been hijacked — meaning the request came from a legitimate inbox, on a legitimate thread, with a legitimate signature block. The fix is procedural, not technical: call back to a number you already had on file before any payment change. If your only verification channel is the email thread the attacker is on, you have no verification.
Figure 01 — The 72-hour incident response clock
The first 24 hours — scope it before you announce it
By hour four, you should know whether this is a one-account BEC or something deeper. The small indicators are usually the tells: a new mailbox forwarding rule pushing payment mail to RSS-Feeds or Conversation-History, a sign-in from a country your CFO has never been to, an MFA bypass via a stolen session cookie. Capture all of it. If you have managed IT or an MSSP, they get the call now; if you don’t, this is the moment to engage IR — through your cyber-insurance panel, since calling someone off-panel can void coverage.
If the breach extends beyond an inbox — ransomware, data exfiltration, customer database access — follow CISA’s I’ve Been Hit by Ransomware checklist: isolate (disconnect, don’t shut down), preserve evidence, identify the variant if possible, and report to CISA and your local FBI field office.
Common first-day mistakes that make recovery worse
- Wiping the compromised mailbox before forensics. The mailbox rules are the evidence. Resetting first destroys the trail.
- Emailing the team about the incident — on the system the attacker still has access to. Use phones, Signal, or an out-of-band channel.
- Paying the “corrected” invoice. The attacker often emails again, mid-incident, with a new account number labeled as a fix. It’s the same scammer.
- Calling the IT vendor before the bank. Money has a clock; logs don’t.
Forensic preservation: what to grab before you touch anything
The most expensive IR mistake is destroying evidence by trying to clean it up before it’s been captured. Most SMBs have no in-house forensics capability — that’s fine. What matters is what you do (and don’t do) between discovery and the moment a DFIR firm picks up the case. They’ll need a clean record of three things: who got in, what they touched, what left the building. Every step before they arrive either helps or destroys that record.
Capture this, immediately, before any “cleanup”
- Disconnect, don’t shut down. Pulling a network cable or disabling Wi-Fi cuts the attacker off but preserves volatile memory — running processes, open connections, decryption keys still in RAM. Powering off wipes most of it. For VMs, suspend rather than power off; the memory state is gold.
- Export cloud audit logs now. Microsoft 365’s Unified Audit Log retains 90 days on most plans (180 on E5); attackers routinely disable or shorten retention as a first move.
- Save the mailbox and the inbox-rules history. Especially the auto-forward rules and any rule routing payment-related mail to RSS-Feeds, Conversation-History, or Archive. Those rules are the smoking gun for BEC, and they vanish the moment a careless admin removes them.
- Pull sign-in logs. Foreign-country logins, MFA prompts answered from unrecognized devices, sessions that survived a password change. Entra ID, Okta, Duo, and Google Workspace all expose them in the admin console.
- Save spoofing artifacts in full source. Save the .eml with full headers (X-Originating-IP, Authentication-Results, Return-Path). Forwarded screenshots are not evidence; the headers are.
- Image the endpoint before anyone touches the keyboard. EDR (CrowdStrike, SentinelOne, Defender) can pull a forensic image remotely; otherwise your DFIR firm will do a write-blocked image. Don’t touch the machine until they arrive.
- Preserve a chain-of-custody log. Three columns: time, action, who did it. Sign and timestamp it. Cyber-insurance subrogation and customer litigation routinely turn on whether evidence handling can be reconstructed; even a small business needs the paper.
What not to do in the forensic window
- Do not reimage, reinstall, or factory-reset the affected machine. That destroys the timeline and frequently ends the investigation before it starts.
- Do not reset the compromised user’s password without coordinating with DFIR. Yes, it’s counterintuitive. The reset can invalidate session tokens forensics still needs and tip the attacker that the response is underway. Isolate the account first (disable, revoke tokens) and reset only when the IR lead says so.
- Do not run a full-environment AV sweep. Most consumer AV products quarantine and modify file timestamps, which mangles the timeline. Targeted EDR queries, yes; broad scans, not yet.
- Do not communicate over the compromised channel. Assume the attacker is reading internal email and Slack right now. Move incident traffic to a phone bridge, an external Signal group, or a separate, fresh Microsoft tenant.
- Do not delete the malicious email. Mark it, save the source file, leave the message in place until DFIR pulls it.
If you have cyber insurance, the policy almost certainly names a panel of pre-approved DFIR firms; calling someone off-panel can void the claim. The two calls that matter in hour two are your broker and the breach coach the carrier assigns — usually a privacy attorney who conducts everything that comes next.
The new extortion: double, triple, and pure
The ransomware story most operators carry — files get encrypted, you pay for a decryption key — is about two years out of date. Modern crews monetize the same intrusion in two or three layers, and a backups-only defense no longer covers the threat.
Double extortion — encrypt and leak — has been the default since 2020 and is now near-universal. Attackers exfiltrate data days or weeks before launching the encryptor, then threaten to publish on a leak site if you don’t pay. Restoring from backups solves the encryption half and does nothing about the leak.
Triple extortion — encrypt, leak, harass — adds a third lever. Crews like Akira and RansomHub email or call your customers, patients, or employees directly with their own data, demanding they pressure you to pay. We saw this at scale against US healthcare networks in late 2025; patient calls land in hours, and the social fallout outruns any plan that wasn’t pre-written.
Pure extortion — no encryption at all — is the newest and hardest model to detect. ShinyHunters, the crew behind the May 2026 Canvas breach of 8,809 institutions, built an economy on vishing into SaaS instances (Snowflake, Salesforce, support tools), exfiltrating, and threatening publication. No malware to detect, no decryptor to debate — just a phone call and a deadline.
How to handle an extortion demand
The single best decision in the first hour of an extortion event is not made by IT. It’s made by the executive who agrees, before anything else, that outside counsel and (if covered) the breach coach will lead all communications.
- Don’t reply from a corporate channel. Engagement from a company email or Slack turns extortion into a discoverable negotiation. Route everything through outside counsel and a professional ransomware-negotiation firm; cyber-insurance panels include them.
- Run the OFAC check before payment is discussed. Payments to sanctioned groups — the successors to LockBit, Conti, Hive — are illegal regardless of business necessity, with civil penalties starting in the six figures per transaction. Treasury’s 2025 ransomware advisory is explicit: paying without OFAC due diligence is an enforceable violation.
- Verify the threat. Ask for proof of exfiltration — a specific file sample from inside your environment. A meaningful share of “we have your data” claims are recycled bluffs.
- Pre-draft the leak-site response. Once a sample goes live, the news-cycle clock is hours, not days. Have a customer notification, a regulator holding statement, and a press line ready before you know whether you’ll need them.
- Coordinate with the FBI. Reporting does not waive the option to pay later. It does unlock case-specific intelligence — including, in several 2024–2025 incidents, decryption keys the FBI had already recovered from a disrupted operator.
Paying does not close the incident; it changes which kind of incident it is. The 2025 DFIR field reports show median time-to-republish for paying victims at 38 days, and roughly half of paying organizations were re-extorted by the same crew within a year.
The first 72 hours — the legal and reputational clock
Once the bleeding has stopped, the notification obligations begin. The rules are not optional and the deadlines are real.
State breach notification. All 50 states have data breach notification laws, most requiring notice within 30 to 60 days of discovering personal information was exposed. Some — California, Colorado, Florida — require parallel notice to the state attorney general above certain thresholds. Have outside counsel run the analysis; the laws differ enough that DIY is a real liability risk.
SEC Form 8-K. If you’re a public company, the SEC’s cybersecurity disclosure rule requires filing Item 1.05 of an 8-K within four business days of determining a cybersecurity incident is material. The clock starts at materiality, not discovery — but boards that drag the materiality call are getting flagged by SEC enforcement.
HIPAA. Healthcare entities have 60 days to notify the HHS Office for Civil Rights and the affected individuals for breaches of 500+ records, and must post on the OCR “wall of shame”. Sub-500-record breaches are reported annually.
Sector and contract obligations. Defense contractors have DFARS reporting. Financial services have state DFS rules (New York’s NYDFS is among the strictest). Many B2B contracts require notice within 24 to 72 hours. Get the contract list on the table now, not next week.
The pattern across our coverage — from ShinyHunters to the 68% of breaches that start with a person, not a system — is that technology rarely fails first. The first failure is almost always procedural.
The week after — close the door behind them
The crew that hit you has your org chart, your invoice templates, your vendor list, and now your IR habits. They will be back. A short post-incident punch list that actually moves the needle:
- Force a password and session reset for every user in the affected tenant, not just the compromised one. Revoke all OAuth tokens.
- Make MFA conditional and FIDO2-based for finance, executives, and IT admins. SMS and push notifications keep getting defeated by adversary-in-the-middle kits.
- Write the callback policy down. “Any payment change, any vendor banking detail change, any executive request for a wire — verified by phone to a number on file, no exceptions.” Put it on the AP team’s wall.
- Run a real tabletop exercise within 30 days. Not a checklist review — an actual run-through with the controller, IT, legal, and a comms lead in the room.
- Schedule the phishing simulations. Phishing-resistance is a perishable skill; one campaign doesn’t hold. Our 30-day SMB rollout plan is the version of this we’ve seen actually work.
The companies that recover well aren’t the ones with the deepest stack; they’re the ones that already knew the phone number for their bank’s wire desk. The ones that recover badly are the ones that had to find it.
Run BEC and ransomware drills before you need the playbook.
ScamDrill sends safe, realistic phishing, BEC, and vendor-spoof simulations to your team — with an instant teachable moment when someone clicks. Boring, quiet, and roughly four hundred times cheaper than the wire you don’t recover.
Start free →One more thing
The incident ends with a postmortem the team actually reads and a short list of changes someone is accountable for closing by Friday. That part is unglamorous and is the only part that compounds. The rest — wires, lawyers, press — is the cost of having waited until it happened to write it down.