Someone Hacked Our Email and Changed an Invoice: What Now?

If a hacker accessed your email and altered an invoice, you are in the middle of a time-sensitive cybersecurity incident known as a business email compromise (BEC). The attacker's goal is to trick you, your customer, or your vendor into sending money to an account they control. Fast, calm, and methodical action is crucial to containing the damage and attempting to recover the funds.

Your immediate focus should be on the money. If funds have already been sent to the fraudulent account, the window to recall them is measured in hours, not days. After addressing the wire transfer, the next priority is to secure the compromised email account to prevent further unauthorized activity. This is a serious situation that requires a swift and precise response.

For immediate 24/7 assistance with a compromised email account and fraudulent invoice, contact our incident response team here.

First Steps After Discovering a Fraudulent Invoice

Discovering that a hacker has intercepted your communications to commit financial fraud is alarming. Follow these steps methodically. Do not delete any data, as it may be needed for investigation.

Contact Your Bank Immediately. If a wire transfer, ACH, or other payment has already been sent to the fraudulent account, call your bank's fraud department right away. Request a wire recall or ACH reversal. Time is the most critical factor. Have all transaction details ready: date, amount, recipient name, and account numbers (both legitimate and fraudulent).
Alert the Other Party. Call the legitimate recipient of the funds (your vendor or customer) to inform them of the fraud. Tell them not to trust any recent emails regarding payment information and to verify all instructions with you over the phone. Do not use email to communicate about the incident until all compromised accounts are secure.
Secure the Compromised Email Account. You must assume the attacker still has access. Take these actions immediately:
- Reset the Password: Change the password for the compromised email account. Make it strong and unique.
- Revoke Active Sessions: In Microsoft 365 or Google Workspace, you can force a sign-out of all active sessions. This will boot the attacker out, forcing them to try and log in again (which they can't, because you changed the password).
- Enable Multi-Factor Authentication (MFA): If MFA was not enabled, turn it on now. This is the single most effective step to prevent an attacker from regaining access, even if they have the password.
Preserve Evidence. Do not delete the fraudulent emails or any related messages. Create a separate, secure folder and move them there. This information is critical for the investigation and for any potential insurance claims or law enforcement reports. Take screenshots of the fraudulent payment instructions.
Report the Fraud to Law Enforcement. File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. The FBI's Recovery Asset Team (RAT) can sometimes assist in freezing and recovering funds if you report the incident quickly.

How Do I Investigate the Email Hack?

Once you have taken the immediate containment steps, you need to understand the scope of the breach. The goal is to determine how the attacker got in, what they accessed, and whether they still have a foothold in your environment. An investigation is essential for ensuring the threat is truly gone and for meeting any regulatory or contractual notification requirements.

Key investigative actions include:

Reviewing Sign-in Logs: In Microsoft 365 (now Entra ID) or Google Workspace, analyze the sign-in logs for the compromised account. Look for suspicious activity, such as logins from unfamiliar locations or at unusual times. Note that sophisticated attackers may use proxies or VPNs to mask their true location.
Checking the Unified Audit Log (UAL): In Microsoft 365, the UAL is your primary source of truth. It tracks user and admin activity across the platform. You can search for activities performed by the attacker, such as creating inbox rules, accessing files, or sending emails. The retention period for these logs depends on your license level.
Searching for Malicious Inbox Rules: Attackers frequently create inbox rules to hide their activity and maintain persistence. These rules might automatically delete incoming emails containing keywords like "fraud," "hacked," or "invoice," or forward copies of sensitive emails to an external address. We cover this in-depth in our guide to stopping unauthorized email forwarding rules.
Scanning for Unauthorized Applications: Attackers can grant themselves access via malicious third-party applications (OAuth apps). Review the applications authorized for the user's account and revoke any you don't recognize.

When to Call for Outside Incident Response Help

You should consider engaging an external incident response firm when you face a complex or high-stakes situation. Invoice fraud resulting from a hacked email account is one of those times. The financial and legal risks are significant, and a botched investigation can lead to continued compromise and greater losses.

Consider calling a firm like Lyra Recovery if:

You Need to Recover Funds: The process of working with banks and law enforcement to recover stolen funds is complex. Experienced responders can help manage this process effectively.
You Lack Internal Expertise: A proper forensic investigation requires specialized skills and tools. If your team doesn't have experience with business email compromise recovery, you risk missing critical evidence or failing to eradicate the attacker completely.
Multiple Accounts May Be Compromised: If you suspect the breach is not isolated to a single account, a wider investigation is necessary to understand the full scope.
You Have Regulatory or Legal Obligations: Industries like healthcare (HIPAA) or finance, or companies that hold sensitive data, often have strict breach notification requirements. A formal investigation and report from a third-party firm can demonstrate due diligence and help you meet your obligations.

An expert incident response team can conduct a thorough investigation, ensure the attacker is fully removed from your environment, and provide a clear report on what happened, what data was exposed, and how to prevent it from happening again.

Frequently Asked Questions

Should I pay the real invoice if the first payment was stolen?

This is a difficult situation that often becomes a business dispute. The answer depends on your relationship with the other party, your contracts, and potentially the law. The first priority is to secure your systems. Then, discuss the situation with the other party. Sometimes the loss is split, but this is a negotiation. Consulting legal counsel is wise.

Can we get the stolen money back?

It is sometimes possible, but never guaranteed. The chances of recovery are highest when the fraud is reported to the financial institution within 24-48 hours. The FBI's IC3 Recovery Asset Team has a good track record, but success depends on many factors, including the speed of reporting and the destination country of the funds. Read more about the process in our article on wire fraud after an email hack.

Does cyber insurance cover invoice fraud from a hacked email?

It depends entirely on your specific policy. Many cyber insurance policies have coverage for social engineering or funds transfer fraud. However, coverage may be denied if the insurer finds that basic security controls, like multi-factor authentication (MFA), were not in place. You must report the incident to your carrier as soon as possible, as they have strict reporting timelines.

Was this also a data breach?

Yes. A compromised email account is a data breach. The attacker had access to all the information in the mailbox, which can include sensitive employee data, customer information, financial records, and confidential business plans. Part of the investigation is to determine what data was accessed or exfiltrated to understand your notification and reporting obligations. Learn more here: Can a Hacked Email Lead to a Data Breach?

The discovery of invoice fraud after an email compromise is a critical moment. Your actions in the first 24 hours will heavily influence the outcome, from the chances of fund recovery to the overall security of your business. If you are navigating this situation and need expert guidance to contain the threat and investigate the breach, the Lyra Recovery team is available 24/7. Contact us through our emergency intake form to get started.