Monday morning. Someone in finance notices a payment went somewhere it should not have.
That is how a meaningful proportion of cyber incidents actually begin for SMEs. Not a dramatic system failure, not a ransom note on every screen, but a quiet, unsettling discrepancy that someone happens to notice. A supplier chasing an invoice you are sure you paid. A bank account detail that does not look quite right. An email in a sent folder that nobody remembers writing.
What happens in the hours immediately afterwards shapes every consequence that follows: how much money is recovered, whether the insurer pays, whether the regulator gets involved, and how much damage is done to relationships with customers and suppliers. Yet most SMEs have never thought through what those hours should look like until they are living through them.
How these incidents usually start
Payment diversion fraud is one of the most common ways a cyber incident first shows itself in a business. In an invoice or mandate scam, a business tries to pay a genuine supplier, but a criminal intervenes and persuades it to send the money to an account they control instead. In a CEO scam, the criminal impersonates a director or senior manager to request an urgent payment.
The scale is significant. According to UK Finance’s latest annual fraud report, invoice and mandate scams alone caused £41.3 million of losses across 2,305 cases in 2025. These are rarely opportunistic. UK Finance warns that criminals may target a business over several months, building a picture of who authorises payments, and can even use information on company websites about genuine suppliers.
Here is the part that matters most for the first hours. A redirected payment is very often a symptom, not the incident itself. If a criminal knew exactly when an invoice was due, which supplier to impersonate and how your finance team writes its emails, there is a good chance they have had access to a mailbox, possibly for weeks. The missing money is what you noticed. The compromised account is what you need to investigate.
The instinctive first call is often the wrong one
The instinct for most businesses is to ring the MSP. That is understandable: they run the systems, they know the environment, and they are the people you call when something goes wrong.
But it is often the wrong first call. An MSP may well have a role to play, but they are also, in many cases, part of the environment being investigated. If the attacker got in through a misconfigured system, a missing control or an unmanaged account, the MSP’s own work is part of the question. That creates a potential conflict between their commercial relationship with you and an impartial assessment of what went wrong. This is not a criticism of MSPs. It is the same reason you would not ask the builder to sign off his own structural survey.
There is also a practical risk. A well-meaning engineer who resets passwords, wipes a laptop or “cleans up” a mailbox can destroy exactly the evidence an investigator or insurer needs. Speed matters, but the wrong kind of speed makes things worse.
The first calls should do three things: establish containment, preserve evidence, and get an accurate picture of scope, before anyone starts making changes that could complicate a later investigation or insurance claim.
What the first hours should actually look like
Every incident is different, but the sequence for a suspected payment diversion or account compromise usually looks something like this.
In the first hour
Call your bank immediately. Use the number on the back of your card or your bank’s official fraud line, not one from an email. Report the payment as fraud and ask the bank to contact the receiving bank. The chances of recovering money fall quickly once it has moved on, so this call cannot wait for an internal meeting.
Call your cyber insurer’s incident line, if you have one. Many policies require you to notify them promptly and to use their appointed incident response specialists. Calling them early protects your claim and often gets you expert help faster than you could arrange yourself. Keep that number somewhere you can find it without access to your email.
Stop further payments to any supplier whose bank details have changed recently until they have been verified by phone using a number you already hold.
Do not start deleting or rebuilding anything. Change passwords on the obviously affected accounts if you need to stop ongoing access, but leave investigation and remediation to people who know how to preserve evidence.
In the first day
Understand scope. Which mailboxes were accessed? Were forwarding rules set up? Were other suppliers or customers emailed from your accounts? Was personal data viewed or downloaded? This is where independent incident response expertise earns its keep.
Bring in the right people: the insurer’s panel, your MSP under direction rather than in charge, and legal advice if personal data or significant sums are involved.
Start a written log of what was found, when, by whom and what was done. This becomes the backbone of any insurance claim, regulatory notification or police report.
Report it. In England, Wales and Northern Ireland, fraud and cybercrime are now reported through Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025.
Within 72 hours
Decide whether a regulatory notification is required. This is where the clock becomes critical.
The regulatory clock is already running
Under UK GDPR, a personal data breach that is likely to result in a risk to people’s rights and freedoms must be reported to the ICO without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it.
“Becoming aware” has a specific meaning. You are considered aware when you have a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. You can carry out a short initial investigation to establish that, but the clock starts when that certainty is reached, not when the investigation is finished.
That distinction matters enormously in practice. If a criminal has been inside a finance mailbox, that mailbox will almost certainly contain personal data about staff, customers or suppliers. The question of whether you are notifying the ICO is therefore one you may need to answer while you are still working out what actually happened. And weekends do not pause the clock: if you become aware on a Friday evening, you should still aim to notify by Monday evening.
The good news is that you do not need all the answers within 72 hours. You can submit an initial notification with the information you have and follow up with more detail as it becomes available. What you cannot do is ignore the deadline. If you report late, you must explain why.
Don’t assume the bank will refund you
Many business owners have heard that banks now have to reimburse victims of authorised push payment fraud. That is true, but only for some.
Since 7 October 2024, mandatory reimbursement rules set by the Payment Systems Regulator cover individuals, micro-enterprises and smaller charities, up to a maximum of £85,000. A micro-enterprise means a business that employs fewer than 10 people and has annual turnover under £2 million.
A business with 25 or 35 staff is outside that scheme. Banks will still look at claims case by case, but there is no automatic right to a refund. For most growing SMEs, recovery depends on how quickly the bank is contacted, whether the money can be traced, and whether you have suitable insurance cover.
Why so many businesses get this wrong
The pattern is not a lack of competence. It is a lack of preparation. According to the government’s Cyber Security Breaches Survey, only a quarter of UK businesses have a formal incident response plan. Even the basics are patchy: assigned roles during an incident exist in 39% of businesses, and written guidance on who to notify in 34%.
Without a plan, decisions get made by whoever happens to be in the office, under pressure, with incomplete information. People call who they always call. Systems get “fixed” before anyone asks what they can tell you. Deadlines slip because nobody knew they existed.
Preparing for the first hours costs a conversation
Board-level awareness of what these first hours should look like, before an incident happens, is one of the most valuable and least expensive pieces of preparation an SME can do. In practice, it means agreeing a few simple things in advance:
- Who is in charge when something happens, and who deputises if they are away.
- Who you call first, with numbers for the bank’s fraud team, the insurer’s incident line and an independent incident response provider, kept somewhere accessible offline.
- What the MSP’s role is during an incident, and what they should not do without approval.
- Who decides about regulatory notification, and how the 72-hour clock will be tracked.
- How payment changes are verified, so a request to change supplier bank details is always checked by phone using known contact details.
- How you will practise it, even if that is a one-hour tabletop exercise walking through a Monday-morning scenario like the one above.
None of this requires expensive technology. It costs a conversation. The alternative costs a great deal more.
If you are not sure who in your business would make the first call, or what that call should be, it is worth talking it through before you need to.