Contain immediate financial and access risks
If a payment may have been redirected or a financial account is at risk, call the financial institution using a verified number as soon as possible. Ask whether the transfer can be stopped or recalled and follow its instructions. If a business email, website administrator or social account is compromised, secure it through the official provider, revoke unknown sessions and remove suspicious access.
Avoid deleting messages, wiping devices or publicly accusing a person before preserving evidence. A fast, organized response helps banks, police, service providers and investigators understand what happened. If customer data may be involved, follow the organization’s incident plan and seek qualified privacy or legal advice about notification obligations that may apply.
Preserve a useful incident record
Record the date and time, sender or account, website address, payment amount if relevant, transaction reference and exact action taken. Save original emails, message headers, screenshots, invoices and case numbers. Keep a read-only copy when possible and note who collected it. Do not share passwords or sensitive customer information in a public post or with an unverified “recovery” service.
A short timeline is useful: when the first suspicious contact arrived, who interacted with it, when the issue was noticed, which accounts were affected, and which providers were called. Separate confirmed facts from assumptions. This prevents different team members from sending conflicting descriptions and helps you update the record as new information arrives.
Use official reporting channels
The Canadian Anti-Fraud Centre accepts reports about fraud and provides guidance on fraud affecting businesses. Its current website explains how to report and what information to prepare. Suspected cybercrime or financial loss should also be reported to local police, and your bank or payment provider should be contacted directly when funds or payment credentials are involved.
A platform report can help remove an impersonation profile, suspicious advertisement or fraudulent listing, but it does not replace a police or CAFC report when the matter involves suspected fraud. Use official addresses typed into your browser rather than links from an unexpected message. Keep every confirmation number with the incident timeline.
Review the controls after the urgent response
When the immediate risk is contained, identify the path that allowed the incident: a changed supplier account without callback verification, reused passwords, an exposed recovery email, weak approval steps or missing backups. Focus on correcting the process rather than blaming the first employee who noticed the issue.
Assign each follow-up action an owner and date. Recheck account access, payment approval, domain ownership, backup restoration and employee training. The Canadian Centre for Cyber Security publishes a baseline for small and medium organizations that can help structure a broader review. Do not claim an incident can never recur; build controls that reduce likelihood and improve response.
Practical checklist
- Contact your bank or payment provider immediately if money is at risk.
- Secure affected accounts using official provider channels.
- Preserve original emails, transaction references and a factual timeline.
- Report through the Canadian Anti-Fraud Centre and local police as appropriate.
In short
Report promptly, preserve evidence and use channels you independently verify. For legal, privacy or cybersecurity decisions, consult qualified professionals.
This article is general educational information, not legal, privacy, cybersecurity or financial advice. Confirm requirements for your situation with a qualified professional.