This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
1. Stop financial loss and active access
If a transfer may have been misdirected, contact your bank or financial institution immediately using an independently verified number. Ask the email provider or IT administrator to revoke unauthorised sessions and secure the affected account.
2. Check what changed
Investigate mailbox forwarding rules, connected applications, sign-ins, recovery settings and messages sent while the account was exposed. Work with an incident responder where the scope is unclear.
- Preserve relevant messages, headers, timestamps and logs.
- Avoid deleting evidence while containing the incident.
3. Notify affected people appropriately
Warn relevant staff, suppliers and customers if fraudulent requests may have been sent. Where personal information has been involved, assess applicable privacy and notification obligations rather than assuming every incident is automatically notifiable.
4. Recover and learn
Reset compromised access securely, enforce MFA, review permissions and payment verification practices, and record what happened.
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Recover from business email compromiseASD’s Australian Cyber Security Centre · 8 September 2026
- Quick reference guide for responding to data breachesOffice of the Australian Information Commissioner · See source
- Business email compromise scamsACCC Scamwatch · See source
