PLAYBOOK · 13 min read
The First 60 Minutes of a Fraud Incident
A step-by-step runbook for the first hour after a confirmed BEC, ATO, or wire-fraud event.
C
CyberPhoenix Research
Minutes 0–15: Stop the bleeding
- Confirm the loss: amount, beneficiary, time of send
- Call your bank's fraud line immediately — push for SWIFT recall on international
- Freeze related accounts if there's any chance of follow-on activity
- Preserve evidence — full email headers, screenshots, logs (no edits)
Minutes 15–30: Activate the response team
- Incident commander: typically CISO, CFO, or legal
- Communications: tight loop only — don't broadcast yet
- External counsel + IR retainer (Cyberphoenix or equivalent)
- Filing: FBI IC3 for US, plus local cybercrime authority
Minutes 30–60: Contain and assess
- Identify how the attacker got in — compromised inbox, lookalike domain, BEC chain
- Force-reset credentials and revoke all sessions for impacted accounts
- Search for parallel activity — is this a single wire or a campaign?
- Notify partners and vendors if they may be next
Hour 1+: Recovery + post-mortem
- Engage on-chain forensics if crypto involved
- Document a factual timeline for insurance and regulators
- Plan the post-incident drill for the same scenario
// Continue the conversation
Need help applying this?
Talk to a senior Cyberphoenix consultant - free, no obligation.
Book a consultation