// first 10 minutes

invoice fraud / vendor account change — quick-start

invoice fraud — first 10 minutes. freeze the payment, preserve the email thread. print this, check boxes, then run the primary tools.

checklist

call the originating bank immediately if a wire or ACH was initiated — recall window is 24–72 hours.
call the legitimate vendor at a known phone number (not from the invoice) — confirm whether they sent the payment change request.
preserve the fraudulent invoice as a PDF and the email delivering it as a .eml — do not forward.
preserve the legitimate vendor's prior invoice for comparison — metadata differences are the evidence.
export email send/receive headers for the fraudulent invoice email — look for lookalike domains and reply-to manipulation.
pull mailbox rules for the accounts involved in the AP or procurement chain — rules are often added to intercept correction emails.
export sign-in logs for accounts that approved or processed the payment change request.
compare the payment instructions (routing/account number) against the vendor's on-file bank details — note the delta.
file at ic3.gov with the recipient account number and wire reference — financial institutions respond faster to IC3 flagged cases.
begin the primary tool path below — email header analyzer and invoice metadata comparison tool.