Identify the change that mattered
Payment diversion may involve a lookalike domain, a spoofed sender, an altered attachment, a compromised account or a genuine account used without authority. The examination should establish which explanation the available evidence supports, without assuming that an unexpected payment instruction proves a particular mechanism.
Relevant evidence
Preserve the complete surrounding correspondence and original attachments where possible. Copies held at different organisations can help establish when wording or bank details first appeared.
- Native messages, transport headers and attachment versions.
- Available sign-in, audit, forwarding-rule, delegation and application-consent records.
- Authorised gateway records and relevant endpoint artefacts.
- A chronology of the discovery, verification calls and account changes already made.
Scope and deliverables
An agreed examination can compare the messages, assess source provenance and correlate events across the available records. Outputs may include an incident chronology, a schedule of changed instructions, an assessment of competing mechanisms and a report identifying unresolved questions. Account activity and human attribution should remain separate findings.
Operational response is a separate instruction
Preservation should be coordinated with the organisation's authorised incident responders and advisers. Necessary account protection should not be delayed solely to leave an incident observable. Record containment actions, who performed them and when. This service description does not promise continuous monitoring, round-the-clock containment, bank liaison or fund recovery.
What cannot be promised
An IP address, valid authentication or a logged account action does not by itself identify the offender. Missing logs may limit reconstruction. Begin with a brief chronology, the relevant organisations and platforms, and any urgent deadline. Do not send passwords, one-time codes or the full evidence set through the general enquiry channel.