If a message may have triggered a fraudulent payment or sensitive-data transfer, involve the organization’s incident and financial response process immediately.
Email and identity containment
For a compromised internal account, revoke active sessions/tokens where supported, reset credentials, enforce strong MFA, and inspect sign-in history, mailbox rules, forwarding, delegates and OAuth grants.
Determine scope
Identify messages sent by the attacker, recipients, deleted or hidden mail, altered payment conversations and other accounts contacted.
Business containment
If payment instructions changed, use a known-good out-of-band contact method to verify the request. Do not rely on phone numbers or reply addresses supplied in the suspicious thread.