# We paid a fraudulent invoice. What should we do now?

Call your bank immediately, by phone, and ask for a recall of the transfer; ask them to contact the receiving bank so it can freeze the funds. Speed decides the outcome: money that has not yet been moved on can sometimes be stopped in the first hours or days, much less often after that. Then report the fraud to the police, keep every e-mail with its full headers, and inform your cyber insurer if you have one, since many policies cover this kind of fraud only under specific conditions and deadlines. Find out how the fraudster knew the details: a lookalike domain, your own mailbox, or the supplier's mailbox? If one of your accounts was used, treat it as an incident: reset it, revoke its sessions, check its inbox rules and who else was contacted. Finally, tell the real supplier, because they may be the compromised party, and tighten the call-back rule for bank detail changes.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/we-paid-a-fraudulent-invoice-what-now

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [A supplier's e-mail account was hacked and they wrote to us. What should we do?](https://netsenx.com/en/faq/supplier-email-was-hacked-what-should-we-do)
- [Why can't a network security tool stop invoice fraud?](https://netsenx.com/en/faq/why-cant-a-network-tool-stop-invoice-fraud)
- [Someone is sending fake invoices in our company's name. What can we do?](https://netsenx.com/en/faq/someone-sends-fake-invoices-in-our-name)
- [How do we stop criminals sending e-mail that pretends to come from our domain?](https://netsenx.com/en/faq/how-to-stop-someone-spoofing-our-email-domain)
- [What is DMARC?](https://netsenx.com/en/faq/what-is-dmarc)