A fraudulent invoice, changed bank details or a convincing email from a director can put an accounts team under immediate pressure. Effective accounting phishing recovery is not just about changing a password. It is about stopping further access, protecting funds, preserving evidence and getting finance operations moving again without creating a second problem.
For a small or medium-sized business, the first few hours matter most. A calm, ordered response gives you the best chance of recalling a payment, limiting the spread of a compromised account and meeting any reporting obligations.
First, contain the incident
As soon as someone suspects a phishing email has been acted on, treat it as a security incident. Do not wait for confirmation that money has left the business or that an attacker has logged in. The goal is to remove the attacker’s access before they can use the account to send more emails, alter payment details or search for sensitive information.
Start by disconnecting the affected computer from the network if a suspicious attachment was opened or software was downloaded. Do not switch it off unless advised by your IT provider, as useful evidence may be lost. If the incident involved a fake login page, reset the affected user’s password from a known clean device and end active sign-in sessions.
The account password is only one part of the picture. Check whether the attacker has changed multi-factor authentication methods, added an email forwarding rule, delegated mailbox access or created a new inbox rule that hides replies. These changes are common in Microsoft 365 compromises because they allow an attacker to keep monitoring conversations after the password has been changed.
If the user has reused the same password elsewhere, reset those accounts too. This is particularly relevant for accounting platforms, online banking portals, supplier systems and personal email accounts used for work.
Preserve the evidence before cleaning up
Keep the phishing email, including its headers where possible, and make a record of what happened. Note the time the email was received, who opened it, what links or attachments were used, which accounts were accessed and whether any payments were approved.
Avoid forwarding the malicious email around the office. Instead, send it to your IT team using your organisation’s agreed reporting method. Screenshots of the email, login alerts and payment confirmations can also help during the investigation.
This information is useful if you need to speak with your bank, cyber insurer, law enforcement, software provider or affected customers. It also helps identify whether the incident was isolated or part of a longer compromise.
Stop and trace any fraudulent payment
If a payment has been made to altered supplier bank details, contact your bank’s fraud team immediately. Use the number on the bank’s official website or your existing banking documentation, not a number supplied in an email. Ask the bank to attempt a recall or trace of the transfer.
Speed makes a real difference. Once funds have moved through several accounts, recovery becomes far more difficult. Your bank may ask for transaction details, the destination account, the date and time, and evidence that the payment was induced by fraud.
Contact the genuine supplier through a trusted phone number already held in your records. Do not reply to the email thread where the banking details were changed. Confirm their actual account details and let them know that correspondence may have been compromised.
It is understandable to want to correct the payment quickly, especially where stock, wages or a critical service is involved. However, do not simply process a replacement payment without independent verification. An attacker may still be monitoring the email conversation and may try again.
For significant losses or suspected criminal activity, make a report through ReportCyber. Your insurer may also require notification within a specified period, even if the financial loss appears manageable at first.
Check how far the compromise reached
The recovery process should establish what the attacker could see and do. A compromised accounts mailbox can expose invoices, customer contact details, payroll records, bank details, tax information and commercial conversations. It may also be used to impersonate staff or directors.
Your IT provider should review sign-in logs, mailbox activity, forwarding rules, sent items, deleted items and access from unfamiliar locations or devices. They should also look for unusual changes to payment approvals, accounting-system users and cloud storage sharing permissions.
The scope depends on the attack. Someone who entered credentials into a fake Microsoft 365 page may have gained mailbox access only. A malicious attachment could have introduced malware to the computer and potentially affected other systems. These situations require different responses, which is why a proper assessment is better than relying on assumptions.
If personal information may have been accessed, seek advice on whether the incident could be an eligible data breach under the Privacy Act. The obligation to notify is not automatic for every phishing event, but businesses covered by the Notifiable Data Breaches scheme need to assess the risk of serious harm and act accordingly.
Restore finance operations safely
Once access has been secured, focus on restoring the functions your business needs to trade. This may include accounts payable, payroll, invoicing, supplier ordering and online banking. Recovery should be deliberate rather than rushed.
Review recent transactions in the accounting platform and banking portal. Look for newly added payees, changed supplier records, altered approval limits, unauthorised exports and payments that were approved outside normal process. Compare changes against audit logs where available.
It is also worth reviewing the email accounts of anyone involved in payment approval, not only the person who received the phishing email. Business email compromise often relies on observing a finance workflow, then impersonating a manager at the right moment.
For a period after the incident, introduce an additional check for payments and bank-detail changes. This may mean a phone call to a known supplier contact or a second person checking high-value transfers. It adds a little friction, but it is preferable to relying on an email instruction that can be forged.
Tell the right people, clearly
Staff need enough information to respond appropriately, without speculation or blame. Explain what happened, what actions are being taken and what they should watch for. If the compromised account sent phishing emails internally or externally, warn recipients not to open recent messages, attachments or links from that address until confirmed safe.
Customers and suppliers may need a direct notification where there is a realistic risk they received fraudulent payment instructions or malicious emails. Keep the message factual. Give them a trusted phone number for verifying future banking changes and make clear that your business will not ask them to update payment details by email alone.
Prevent the next accounting phishing attempt
The best prevention controls are practical and layered. Multi-factor authentication should be enabled for email, accounting platforms and online banking. Where possible, use an authenticator app or security key rather than relying only on SMS codes.
Email security tools can block many malicious messages, but they will not stop every targeted invoice scam. Staff training remains valuable when it is focused on the situations people genuinely face: changed bank details, urgent payment requests, unexpected shared files and emails that appear to come from directors or regular suppliers.
Payment processes deserve the same attention as technology. A documented rule requiring independent verification of supplier bank-detail changes is one of the most effective controls a business can implement. It should apply even when the email looks familiar and the request appears urgent.
Backups are also part of recovery planning, particularly if phishing leads to ransomware or deleted cloud data. Check that backups are monitored, tested and separate from the systems they protect. A backup that has never been restored is not yet a reliable recovery plan.
For businesses across the Central Coast, Newcastle and the Hunter, a managed IT partner can help turn these measures into routine processes rather than a one-off reaction after an incident. That includes monitoring Microsoft 365, reviewing security settings, supporting staff and maintaining an incident response plan that reflects how your business actually operates.
A phishing incident can feel personal, particularly when a careful staff member has been deceived by a convincing message. The useful question is not who to blame. It is whether the business can contain the issue quickly, verify its financial position and make the next attempt harder to succeed.
