Start with the complete sequence
Identify the original payment instruction, the disputed replacement, the payment date and when the issue was discovered. Preserve both sides of the correspondence where authority permits. An isolated final message may omit the point at which the parties began exchanging messages with a different account or domain.
Potential sources
Native messages, attachments, available sign-in and audit records, forwarding rules and gateway records may help. Relevant verification calls and account-protection actions should be documented as part of the supplied chronology. Keep email evidence separate from assumptions based only on the destination bank account.
Coordinate response and examination
Necessary containment and account protection should be coordinated with authorised responders and recorded. Do not leave a compromise active solely for later examination. A forensic assessment can compare wording and files and identify supported mechanisms, but cannot promise offender identification, bank liaison or recovery of funds. Describe the platforms and urgent deadlines when making an initial enquiry. Agree a transfer route before sending the message set or confidential payment documents.