What should a business do in the first 72 hours after discovering fraud? The short answer: stop further loss, preserve evidence, appoint a response lead, consider banks, insurers and regulators, and keep communications controlled. The precise order will depend on the facts, but delay can reduce the chances of recovery.
The first instinct is often to work out exactly what happened. That matters, but the immediate priority is to keep the position from getting worse and preserve the organisation’s options.
What general counsel need to know:
Contain the incident without accidentally destroying evidence.
Keep the response team small and give one person authority to coordinate it.
Contact banks and review insurance promptly.
Consider reporting duties and urgent recovery options early.
Do not assume that involving lawyers makes every document privileged.
Keep a record of key decisions and the information available at the time.
A practical 72-hour plan
First hours: Stop and preserve
Pause further payments where appropriate.
Secure affected accounts, systems and access credentials.
Contact the relevant banks or payment providers.
Preserve emails, messages, logs, payment records and devices.
Limit information to those who need to know.
Avoid confronting suspected individuals before the risks have been assessed.
Technical changes made with good intentions can overwrite logs or alter records. Legal, IT and forensic teams should therefore coordinate their first steps.
First 24 hours: Take control
Appoint a response lead and identify the decision makers.
Record what is known, unknown and assumed.
Agree the immediate purpose and scope of the investigation.
Check contractual, regulatory, employment and data issues.
Review insurance policies and notification requirements.
Agree who can communicate internally and externally.
The aim at this stage is not to reach a final conclusion. It is to prevent further harm, protect evidence and keep options open.
Hours 24–48: Understand the exposure
Map how the fraud occurred and where money, data or assets went.
Identify the banks, recipients, suppliers and internal teams involved.
Consider whether urgent recovery or court action may be needed.
Identify any notifications to regulators, law enforcement or counterparties.
Secure witness evidence.
Consider how privilege should be managed.
Hours 48–72: Agree the plan
Set the investigation structure, responsibilities and reporting timetable.
Rank recovery options by urgency, evidence, likely return and cost.
Coordinate legal, technical, HR, communications and insurance workstreams.
Brief senior leadership on confirmed facts, uncertainties and decisions needed.
Agree immediate remediation without compromising the investigation.
What's at stake?
Evidence: Emails, logs and records can be deleted or overwritten. Preservation instructions should be clear and workable.
Recovery: Money can move quickly through several accounts. Early contact with banks and specialist advisers may preserve options, although recovery is never guaranteed.
Privilege: Privilege depends on the purpose and context of each document or communication. It should be considered at the outset, not assumed later.
Confidentiality: A suspected fraud may involve someone inside the business. Keep the team small so that evidence or assets are not put at further risk.
Reporting and insurance: The incident may trigger regulatory, contractual, data, employment or insurance requirements. These need to be checked against the facts.
Common early mistakes
Starting informal enquiries without a clear lead or record.
Allowing different teams to contact the same parties separately.
Circulating unverified allegations too widely.
Altering systems before evidence is preserved.
Waiting too long to contact banks or insurers.
Focusing only on the suspected fraudster rather than the wider transaction chain.
What should general counsel lead?
General counsel is well placed to:
Set the legal framework and governance for the response.
Bring together internal teams and external advisers.
Protect evidence and manage privilege.
Identify reporting, insurance and recovery choices.
Control communications.
Give the board clear recommendations.
Frequently asked questions
Should we contact the bank before completing the investigation? Usually, yes. Suspected fraudulent payments should normally be reported promptly because delay may reduce the chance of stopping or tracing funds.
Should we confront a suspected employee immediately? Not automatically. Doing so may put evidence, assets or confidentiality at risk. Legal, HR and investigative issues should be considered first.
Does bringing in external lawyers make the investigation privileged? No. Privilege depends on the legal test and the purpose and circumstances of the relevant communication or document.
When should insurers be notified? Relevant policies should be reviewed immediately. Notification and consent requirements vary, and late notice may affect cover.
When might urgent court action be needed? Possible options include orders to freeze assets or obtain information, depending on the evidence, urgency and proportionality. Specialist advice is needed.
Final thought
The organisation’s exposure will be shaped not only by the fraud, but by how it responds. A clear plan and disciplined early decisions can help contain loss, preserve evidence and improve recovery prospects.
For more information or to discuss any of the points in this article, please get in touch Sarah Jacobs or a member of our fraud and investigatory team.
You can also explore Deception Diaries, our fraud forum providing regular articles with insights on fraud-related issues, legal developments, and practical strategies to help businesses prevent and address fraud.
Our content explained
Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.