The first call is to your sending bank: five things to say
Only one action in recovering a diverted payment is time-critical: getting the bank to stop the money. Do not write an email first, do not hold a meeting, do not confront the other party. Call your bank's hotline or relationship manager, then go to the branch with identification and confirm in writing. Say five things. This transfer was sent as a result of fraud and I am requesting an immediate recall. Here are the date, amount, currency, reference number and recipient account details. Please contact the receiving bank now and ask them to freeze the funds in that account. Please give me a case reference and the name of the officer handling it. What further documents do you need, such as a police report or a sworn statement?
How recoverable the money is depends heavily on the channel. A cross-border wire spends longer in transit, and a recall has a better chance if the funds have not yet been credited. A domestic instant transfer in the Philippines arrives almost immediately, so the hope is that the money is still sitting in the recipient account. E-wallet transfers are similar, and you should contact the wallet provider's support at the same time. In every case work both ends: your own sending bank and, where you can identify it, the receiving bank. The receiving bank will not normally tell you who holds the account, but a fraud report triggers internal procedures that allow it to act on the account.
Be prepared for the limits. A bank accepting your request does not mean the money returns. Whether a freeze happens, how much is caught and whether it is eventually released to you depend on whether funds remain and on the legal process that follows, and nobody can promise an outcome. But without this call there is no chance at all. Make it before anything described below.
The second call is to the real counterparty: by phone, never through that mailbox
Tell the other side by phone or in person, using a number you already had on file, not the number in the email signature. At this point you do not know whether your mailbox was compromised, whether theirs was, or whether neither was and someone registered a look-alike domain one character off and inserted themselves into the thread. If you keep using email, the fraudster may be reading it, and may even reply as your counterparty confirming receipt in order to delay your report to the bank.
Confirm three things on the call. Has their real receiving account ever changed? In most cases it has not, which confirms the fraud. Did they receive this payment? Have they recently received suspicious emails in your company's name asking for a change of account or chasing payment? That last answer helps locate which side was breached. Ask them to check their own mailbox security and to warn their other customers.
Then comes the hardest question: the money did not arrive, so is the invoice still owed? A contractual duty to pay does not usually disappear because the payer was deceived. Paying a fraudster is not paying the supplier. But where the fake details went out because the supplier's own mailbox was compromised, there is room to discuss how the loss is shared. Do not argue fault on that first call, and do not promise either to pay again or to refuse. Agree the facts, preserve evidence on both sides, and negotiate afterwards. Whether the loss can be shared and how the contract reads are questions for a lawyer looking at the actual terms and evidence; the available routes are described in how contract disputes are resolved in the Philippines.
Preserving evidence: keep the original emails, not forwards or screenshots
The core evidence in a business email compromise case is the emails themselves, as originals with full headers. Screenshots and forwards strip out the header information, including the true sending server, the reply-to address and the delivery path, which is exactly what shows whether a mailbox was taken over or a domain was imitated, and what investigators and banks will ask for. Find the email requesting the change of bank details and the messages around it, export each one using the save as original or show original function, and delete nothing.
Preserve alongside them the transfer confirmation and bank statement, the original receiving account stated in the contract, order or invoice, the bank, name and number of the fake account, the time and reference of your call to the bank, and a note of when you phoned the counterparty and what was confirmed. Arrange it all into one chronological list.
Then inspect the mailbox itself, capturing evidence before you clean up. Look in four places. Forwarding rules, or rules that move messages containing words such as payment, invoice or bank into an obscure folder: this is the classic sign of a fraudster watching quietly for weeks, so screenshot the rule before deleting it. Recent sign-in history for unfamiliar locations or devices. The recovery email and phone number, in case they were changed. Third-party applications granted access that nobody recognises. Compare the sender address character by character. In many cases nobody's mailbox was breached at all; the fraudster simply used a domain in which a letter was replaced by a similar-looking digit. If your own mailbox was compromised, go on to assess whether customer data was exposed, following the customer data breach response guide.
Reporting: what to bring, and why it changes what the bank can do
File a complaint promptly with the police anti-cybercrime unit or the National Bureau of Investigation's cybercrime division, and give the acknowledgement to your bank. Many banks take further action on a recipient account, or open coordination with the other bank, only once they hold a formal complaint document. Reporting is therefore part of the banking track, not something to do later. Bring the company's registration papers with the authorised representative's ID and authorisation letter, the chronological list, the original emails with headers in electronic and printed form, the transfer confirmation, the fake account details and the bank's case reference. How to fix electronic evidence properly is explained in the cybercrime reporting guide.
If the fake account is in the Philippines, there is an identified account holder behind it, possibly someone whose account was rented or borrowed, and that gives investigators a starting point. If the money went abroad, consider reporting to law enforcement where the receiving bank is located as well, or having your bank send a fraud notice to the receiving bank. A lawyer can advise which is likely to be most effective.
Several things to avoid. Do not track down and confront the account holder yourself. Do not trust any person or agency that contacts you afterwards offering to recover the funds for an upfront fee; that is a second fraud aimed at victims. Do not publish the account holder's name on social media, which can create legal trouble of your own. Progress after a complaint can be slow. Turn your attention to two things in the meantime: settling the unpaid invoice with your counterparty, and closing the gap in the company's payment process. If the company holds relevant insurance, notify the insurer within the policy's time limit.
Inside the company: the accountant made the transfer, so who bears the loss
The employee who processed the payment is, in principle, a victim rather than a suspect, so hold back on blame. Business email compromise works because the email matches the real thing in tone, signature and context, and is often timed for when the owner is travelling or the month-end rush is on. If the first reaction is to berate the person involved, the usual result is that the next person who notices something odd stays silent, and the next loss is larger. Steady them, and ask for a full written account of what happened. That statement is part of the police file.
A different situation deserves serious attention: signs that someone inside cooperated. The fake details appeared with suspicious precision, the payment bypassed the usual approval, or the person deleted emails afterwards. That calls for a formal investigation with preserved evidence, written notice and a chance to explain before any decision, the same procedure described in how to handle employee theft. Make no accusation without evidence.
Recovering the loss from an employee is not simple in the Philippines. Deductions from wages are tightly restricted by labour law, and requiring an employee to compensate the company on grounds of negligence needs a proper basis and procedure; the owner's say-so is not enough. In most cases the realistic view is that the loss is the price of a process gap rather than a personal debt. Two internal steps remain. Tell all staff what happened and how payments will be verified from now on. And tell every regular supplier and customer that the company's receiving account has not changed and that any future change will be confirmed by phone. That also protects them from being targeted by the same group.
Change the payment process: three rules, and what Yixing can do
This fraud is preventable at almost no cost, and it comes down to three rules. First, every new or changed receiving account is verified by a call back. The call goes to a number already on file, never the one given in the email, and ideally the person verifying is not the person processing. However genuine the email looks, however urgent the request, and whether the stated reason is a bank audit or an account upgrade, there are no exceptions. Second, two people on every payment. One enters, one approves, and above a set threshold the owner confirms personally through a channel other than replying to the same email.
Third, guard the mailbox. Turn on two-step verification for every company email account. Do not handle company payments through free personal mail. Review forwarding rules regularly. Register the obvious misspellings of your domain, or at least train finance staff to read the sender address character by character. Before a first payment to a new supplier, verify the entity; the method is in supplier due diligence in the Philippines. Contracts can also state the receiving account and how any change must be communicated, which makes responsibility clearer if something goes wrong.
Yixing Travel Consultancy (SEC Registration No. CS202009551, Bureau of Immigration Accredited Agency No. CA-202624381-1) provides compliance retainer services to foreign-owned companies in the Philippines: helping document payment and reconciliation procedures, verifying the registration details of local counterparties, assembling the company papers and timeline that the police and the bank require after an incident, and connecting you with licensed counsel. We are not a bank, a law firm or an investigator, and we cannot and do not promise the recovery of any funds. What we can do is make sure the right documents are submitted once and in full during the days that matter most. For your specific case consult a licensed lawyer; this article is not legal advice.
Frequently Asked Questions
We paid an invoice to a fake bank account. What is the first step?
Can the money be recovered?
The money was stolen. Do we still have to pay the supplier again?
How do we tell whether our mailbox or theirs was hacked?
Should we report it, and to whom?
Our accountant made the transfer. Can the company make her pay?
How do we stop this happening again?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation