How the loss usually comes to light
Most companies learn about invoice fraud long after the payment left, when the real vendor calls about a bill that was never paid. The setup is almost always the same: someone has been reading an email thread, on your side or the vendor's, and waits for a genuine invoice to go out before sending a corrected one with new payment instructions. Because the thread, the signature block, and the document format are all real, accounts payable has no obvious reason to stop. In many matters the intrusion was on the vendor's system, not yours, which is part of why the dispute afterward gets complicated. Being taken in this way does not mean your controls were careless.
What to preserve before anything else
Keep the original email and the replacement one in full, with message headers, rather than forwarded copies or screenshots. Save both versions of the invoice, the wire or ACH confirmation, and the internal approval trail showing who authorized the change and on what basis. Do not reset the affected mailbox or delete forwarding rules until it has been examined, because those rules often show how long someone had access. Call your bank's fraud line the same day and ask what recall or freeze steps exist; whether anything can be held back depends on where the funds went and how quickly they moved. Write down names, times, and reference numbers for every call you make.
Sorting out who carries the loss
Two questions usually run at once. One is whether any of the funds can still be traced, which turns on the receiving banks and on timing more than on anything else. The other is the dispute with the vendor over whether the underlying bill has been satisfied, since each side tends to argue the other's system was the one that was compromised. Crime or cyber coverage in your business policy may apply, and the notice provisions in those policies are often unforgiving. When we first speak, we look at the email evidence, the payment path, the contract terms with the vendor, and the policy language, and tell you which of those routes is worth your time and which is not.
