ProofRelayYou've paid a scammer. What to do in the first hour
If you have just realised a payment went to a fraudulent account, the most useful thing to know is that the next few hours matter more than everything else combined. Funds are often moved on quickly, and recovery odds drop sharply — after roughly 72 hours, very little is usually recoverable.
Work through these in order. Do not wait until you have the full picture; you can investigate after the bank has been told.
1. Call your bank now
Ask them to attempt a recall of the payment. Use the fraud or emergency line rather than general enquiries, and say clearly that the payment was made as a result of a scam so it is routed correctly.
If the receiving account is at a different bank, your bank contacts theirs. The faster that starts, the better the chance the money is still sitting there.
Do this before anything else on this page, including gathering evidence. Minutes matter and the bank can begin work while you assemble the details.
2. Preserve the evidence, unaltered
Keep the original email with its full headers intact. Do not delete it, do not forward-and-delete, and do not clean up the mailbox. Full headers carry routing information that investigators use and that a forwarded copy often loses.
Save the invoice or attachment as received, and note the exact time and amount of the payment along with the account it went to.
3. Report it
In Australia, report to ReportCyber at cyber.gov.au — this is the official channel that routes to police — and to Scamwatch, which feeds national intelligence on active campaigns.
Outside Australia, use your national cybercrime reporting service. In every jurisdiction, an official report number is usually required by insurers and is sometimes required by the bank.
4. Check whether your own mailbox was compromised
If the fraud involved your email being read or replied to, assume the mailbox may be compromised until you have checked. Change the password, sign out all sessions, and turn on multi-factor authentication if it is not already on.
Then look specifically for mail rules you did not create — particularly auto-forwarding rules or rules that move messages to an obscure folder. Creating a hidden rule is the standard next step after a mailbox is broken into, because it lets the attacker see replies without the owner noticing.
5. Tell the real supplier
Call them on a number you already had. If the fraud came from their compromised mailbox, they may not know, and every one of their other customers is being targeted with the same approach right now.
This conversation is uncomfortable and it is worth having anyway. It is also, frequently, how the source of the compromise is finally identified.
6. Check your insurance carefully
Notify your insurer promptly — most policies require it, and late notification is a common reason claims are declined.
Read the policy for how this type of loss is treated. Many cyber policies exclude fraud where an employee was deceived into making the transfer voluntarily, unless a specific social engineering or crime endorsement has been added. Businesses routinely believe they are covered for this and are not.
Afterwards: the conversation that matters most
The single biggest factor in whether money is recovered is how quickly the person who made the payment tells someone. Shame costs hours, and hours cost everything.
Whatever else changes afterwards, make it explicit and repeated that reporting a suspected mistake immediately is the correct action and will not be punished. A team that is afraid to report loses far more than a team that occasionally reports a false alarm.
Common questions
Is the money usually recoverable?
Sometimes, and it depends almost entirely on speed. If the receiving account is frozen before the funds are moved on, recovery is realistic. Once the money has been withdrawn or transferred onward — often within hours — it rarely comes back.
Should I contact the receiving bank myself?
Go through your own bank. They have established channels for recall requests between institutions and the receiving bank will generally not act on a request from an unrelated member of the public.
Will reporting it to police actually help?
It may not recover your money directly, but a report number is frequently required by insurers, contributes to identifying repeat offenders and mule accounts, and is how patterns across many victims get spotted.
Related guides
- Is this invoice a scam? Seven checks before you pay
The seven things worth checking on an invoice that doesn't feel right, and the one check that actually settles it.
- A supplier emailed new bank details. What should you do?
The single most common way businesses lose large sums — and a short, repeatable process that stops it.
- How to stop invoice fraud in a small business
A practical checklist across email, process, banking and people — with an honest note about which items matter most.