Your Email Is Lying to Your Customers: A 120-Minute Triage Plan

It usually starts with something small. A supplier says they never sent that invoice. A customer replies to a message you have no memory of writing. Or a member of staff notices a rule in Outlook they did not create, quietly forwarding anything containing the word 'invoice' to an address nobody recognises.

That is the moment to stop treating it as an email problem and start treating it as a business incident. The first two hours are not about performing cybersecurity theatre. They are about stopping the attacker sending more mail, protecting money, preserving evidence, and telling the right people in the right order.

Minute 0-10: stop the bleeding, not the business

If you suspect a mailbox has been taken over, do not switch off the whole mail server or send a dramatic all-staff email. Start with access.

Change the password for the affected account from a clean device, then revoke active sessions so the attacker is signed out. If you use Microsoft 365 or Google Workspace, your admin can do this in the security settings. If you cannot get in, call your IT provider or the platform's support line and use the words 'suspected business email compromise'. That phrase should get you taken seriously.

If you think a laptop or phone is infected rather than just the mailbox, disconnect that device from Wi-Fi and unplug the Ethernet cable. Do not wipe it yet. You may need it for evidence.

Minute 10-25: get the right people in the room

You do not need a crisis committee. You need three or four people who can make decisions: the owner or manager, whoever has admin access, whoever handles finance, and your bank or insurer if money is involved. One person should keep a simple log of what happened and what you did, with times.

Use a phone call or a separate messaging channel. Do not coordinate the response inside the compromised mailbox. If you have cyber insurance, ring the incident helpline now and ask what they need. Do not wait until you have a tidy story.

Minute 25-45: preserve evidence before you tidy up

This is the bit most small businesses skip, and it is the bit that matters when insurers, banks or the authorities ask questions later.

Do not delete suspicious emails, sent items or inbox rules. Export or screenshot the mailbox rules, forwarding addresses, delegate permissions, connected apps and sign-in logs. If you can, save the full email headers for any fraudulent message. Note the exact times, sender addresses, bank details and who received what.

If you are not sure how to export logs, ask your IT provider to do it before anyone starts 'cleaning up'. A tidy mailbox is a terrible witness.

Minute 45-70: warn the people who need warning

Tell staff first, using a channel that is not the compromised mailbox. Keep it short: 'We are dealing with unauthorised activity on an email account. Do not act on payment requests or bank detail changes by email until further notice. If you are unsure, call the person on their usual number.'

Customers and suppliers only need to hear from you if fraudulent messages have actually gone out. Do not send a generic alarm to everyone. If invoices with changed bank details have been sent, ring the key clients directly. A short script is fine: 'You may have received an email from our account that we did not send. Do not make any payment changes. Please call us on this number to check.'

Do not send that warning from the compromised address. Use a different mailbox, your website contact form, a phone call or a text. And do not blame the person whose account was hacked. Panic and blame make people hide things.

Minute 70-95: close the obvious doors

Once access is under control, check the things attackers commonly leave behind. Look for inbox rules that delete or forward messages. Check forwarding addresses, mailbox delegates, app passwords, connected third-party apps and extra MFA methods. Remove anything you do not recognise.

Reset passwords for any other account that used the same password. Turn on multi-factor authentication everywhere it is available, especially on email, finance and admin accounts. Run a malware scan on the device that was used to access the mailbox. If the attacker had access for more than a few minutes, assume they read more than the sent items.

If you use Microsoft 365, check the audit log for unusual sign-ins, mailbox searches and file downloads. If you do not have audit logging switched on, that is a job for after the incident, not during it.

Minute 95-120: report and start the paper trail

Report the suspicious emails to the NCSC's Suspicious Email Reporting Service by forwarding them to [email protected]. Report the fraud to Action Fraud online or on 0300 123 2040. If personal data may have been accessed, check whether you need to report it to the ICO within 72 hours. If money has moved, call your bank's fraud line immediately and ask about recalling the payment. Then update your insurer with the timeline and reference numbers.

The keep-it-offline checklist

Print this and keep it somewhere you can reach when the network is on fire.

• Change the affected mailbox password from a clean device.
• Revoke active sessions and sign the attacker out.
• Turn on or reset MFA for the account.
• Disconnect any suspect device from the network.
• Call your IT provider and say 'suspected business email compromise'.
• Tell the owner, finance lead, bank and insurer.
• Preserve inbox rules, forwarding, sent items and email headers.
• Check for fraudulent payment requests and call the bank if needed.
• Warn staff via a non-email channel.
• Warn affected customers or suppliers only if fraudulent mail went out.
• Remove unknown inbox rules, delegates and connected apps.
• Reset reused passwords and check other accounts.
• Report to NCSC SERS and Action Fraud.
• Check ICO reporting duties if personal data was involved.
• Write down what happened, with times, and keep the references.

What not to do

Do not pay a fraudulent invoice in the hope it can be sorted later. Do not wipe the mailbox or the laptop before evidence is saved. Do not send a warning from the compromised account. Do not assume a password change alone fixes it. And do not turn the first two hours into a blame meeting. The priority is containment, evidence and communication.

After the first two hours

Once the immediate fire is out, fix the boring things. Put a callback rule in place for any change of bank details. Make sure finance staff can verify payments by phone using a number they already had, not one in the email. Turn on MFA for every admin account. Review mailbox permissions. Train staff to spot the difference between a spoofed email and a real account takeover. Check that your backups and cloud data are protected, because email is where a lot of business records live.

You will not do all of that in 120 minutes. But you can stop the attacker, protect your customers and keep a clear record of what happened. That is a good first two hours.