The Email That Could Have Cost £2 Million: Four Lessons
A fraudulent email led to an unauthorised payment. The business recovered the vast majority of the money, kept its customers' confidence and gave its leadership a clear account of what had happened.
This article covers the four things that made the difference, and three questions that will tell you whether your business would get the same result. If it is useful, forward it to whoever runs your finance team. They are the people this story turns on.
We will also walk through the full incident live at our free webinar on Wednesday 25 November at 12pm. Register on Eventbrite
How it started
The first message did not sound urgent. Someone in a finance team logged a service desk ticket about something that looked a little odd. They had no idea they were describing a serious security incident.
Most incidents start like this. Not with alarms and red screens, but with a quiet, slightly unsure report from someone who is not sure whether they are wasting anyone's time.
The business, which we are keeping anonymous, is a client we supported through exactly that situation this year. Afterwards, they told us which parts of the response had mattered most. None of it was luck, and much of it was not about technology at all.
Lesson 1: The first hour is decided before the incident
The initial ticket contained very little information. What made the difference was treating it seriously anyway: assessing it quickly and escalating it before anyone had confirmed the worst.
"The speed of response was impressive. Even with limited information at the outset, the team quickly understood the seriousness of the situation and gave us confidence that the incident was being managed properly."
That speed depends on two things you put in place long before anything goes wrong.
The first is a culture where people report early. The finance colleague who raised the ticket did exactly the right thing, even without understanding what they were seeing. If your team worries about looking foolish or being blamed, the report arrives a day later, and a day is often the difference between money you can recover and money you cannot.
The second is a provider who escalates on pattern, not certainty. A ticket that sounds minor but touches finance, payments or a mailbox deserves a closer look.
Lesson 2: Evidence is what gets the money back
The detailed forensic investigation established what had happened, what was at risk and what needed to happen next. It also produced an evidence trail, and that trail is what helped the business recover the vast majority of the money. Without it, the conversation with the bank would have been far harder.
Protect the evidence from the start. Resist the instinct to delete suspicious emails, reset everything at once or tidy up before an investigation has captured what it needs. Contact your bank quickly, and you will be in a much stronger position if you can show them exactly what happened.
Lesson 3: A plan people can act on
During an incident, a long list of findings is not much use to a leadership team. What helped this client was a structured action plan that separated immediate priorities from longer-term recommendations, and showed clearly what had already been done and what the business needed to do next.
"The structured action plan made a stressful situation much easier to manage. We knew what had already been done, what we needed to do next, and what our priorities should be."
That meant the internal team could focus on running the business while specialists handled the investigation. This structure is worth borrowing even if you never have an incident: a finding without an owner and a timescale is just an observation.
Lesson 4: Communication contains the consequences
The technical work contained the incident. Communication contained the consequences.
Leadership needed regular, reliable updates they could pass on to senior stakeholders. The same structured summary then shaped what the business told its customers: what had happened, what had been contained, what had been done and what was still in progress. A clear, factual account limited the reputational impact and showed the situation was under control.
Three questions to test your business
In our Kepler framework, everything above is Foundation territory: improved resilience and a defensible baseline. It is not glamorous, but everything else is built on it.
Would someone in your finance team feel comfortable reporting something that just looks odd?
Do you know exactly who you would call, and how quickly they would respond?
Could you give your board and your key customers a clear, factual account within a day?
If any answer is uncertain, you are in good company. Most businesses we speak to have at least one gap here, and the most common is the relationship with their IT partner sitting largely unused until the moment it is needed.
Your next step
Before 25 November, ask your finance lead the first question above. Then join us at 12pm on Wednesday 25 November for the full story, including how AI is changing both the attacks and the defences, and bring them with you.
Comments