What to Do After a Business Email Compromise in Nevada: A Step-by-Step Response Guide

You just discovered that a payment went to the wrong account, or that someone has been reading and sending email from an employee’s mailbox. Your stomach drops. This guide is for the next few hours and days.

Business email compromise (BEC) is the costliest category of cybercrime the FBI tracks year after year. The Internet Crime Complaint Center’s 2025 annual report put BEC losses at roughly $3 billion in the United States, and that counts only what was reported. It happens to small Nevada businesses, title companies, contractors, medical practices, and nonprofits every week.

Time matters more than anything else here. Print this page or save it to your phone before you need it.

First, what kind of incident is it?

BEC shows up in two common forms, and some incidents are both:

• A fraudulent payment. An employee was tricked by a fake or spoofed email, a hacked vendor account, or a deepfake call into sending money or changing bank details.
• A compromised mailbox. Someone got into a real account, often through a phishing page that stole the password, and is reading mail, creating hidden forwarding rules, and sending messages as your employee.

Start with money, because the recovery window closes fastest.

In the first hour: the money

1. Call your bank now

Phone the fraud or wire department at your bank, not just the branch. Tell them you have sent a fraudulent wire or ACH payment and ask them to initiate a recall and to contact the receiving bank. Give them the date, amount, account numbers, and the destination bank. Ask for a reference number and the name of the person you spoke with.

Speed decides whether funds are still there. Once criminals move money out or convert it, recovery becomes much harder.

2. File a complaint with the FBI’s IC3

Go to ic3.gov and file a complaint immediately, ideally within 24 to 72 hours of the transfer. Include the account and routing numbers, amounts, dates, email addresses, and the message headers if you have them.

IC3 is the front door to the FBI’s Recovery Asset Team, which works with banks to try to freeze fraudulent transfers under a process called the Financial Fraud Kill Chain. Historically it has been aimed at larger wires, with a common threshold of $50,000 sent within about 72 hours, though you should report smaller losses too. According to the IC3 2023 annual report, the team froze funds on the large majority of cases where it acted. The lesson is simple: report fast. Nevada is covered by the FBI’s Las Vegas field office, and IC3 routes your complaint to the right place.

The FBI’s public service announcement on BEC explains the scheme and reporting steps.

3. Report to local police

File a report with your local agency, such as Reno Police, Sparks Police, or the Washoe County Sheriff, and keep the report number. Your insurer, your bank, and any dispute process will likely ask for it.

In the first day: secure the mailbox

If any account may have been accessed, contain it before doing anything else on that account.

4. Reset and lock down the account

• Change the password from a clean, trusted device.
• Sign out all sessions and revoke tokens. Changing the password alone may not end an attacker’s existing session.
• Reset and re-enroll multi-factor authentication. Attackers sometimes add their own MFA method.
• Change passwords on any other account that shares the same password or that received a reset link in that mailbox.

5. Hunt for the attacker’s leftovers

This is where cleanups often fail. Check for:

• Inbox rules and forwarding. Look for rules that forward mail to outside addresses, auto-delete messages containing words like “invoice” or “wire,” or move mail to obscure folders.
• Delegates and mailbox permissions that were added.
• Connected apps or OAuth grants you do not recognize.
• Sent items and deleted items for messages the employee did not send.
• Sign-in logs for logins from unusual locations or unfamiliar devices.

6. Preserve evidence

Do not wipe, reinstall, or delete anything yet. Save the original fraudulent emails with full headers, wire confirmations, sign-in logs, and a timeline of who did what and when. Your bank, the FBI, your insurer, and any forensic firm will want it.

Within the first day or two: the people and paperwork

7. Notify your cyber insurance carrier

If you have a cyber or crime policy, read the notice provision and call the claims line promptly. Many policies require prompt notice and may require the insurer’s approval before you hire outside vendors, and delay can jeopardize coverage. Ask about your funds transfer or social engineering sublimit and any conditions attached to it. If you are not sure what your policy says, see our guide to cyber insurance requirements.

8. Alert the people who might be next

Warn your vendors, customers, and employees, using a phone number or channel you already trust, not a reply to the compromised thread. If the attacker used your mailbox, your contacts may be receiving convincing fake messages from you right now. A short, plain warning can prevent a second victim.

9. Consider legal counsel

If significant money or sensitive data is involved, talk to an attorney who handles data incidents. They can advise on privilege, notification duties, and communications.

Was personal information exposed? Nevada’s breach law

A compromised mailbox often holds customer and employee details, such as names with Social Security numbers, driver’s license numbers, bank account numbers, or medical information. That may make it a “breach of the security of the system data” under NRS 603A.220. In plain terms:

• If personal information as defined in NRS 603A.040 was acquired without authorization, a data collector generally must notify affected Nevada residents in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement and any steps needed to restore system integrity.
• If more than 1,000 people must be notified at one time, the business must also notify nationwide consumer reporting agencies.
• The Nevada Attorney General’s office accepts notices of data breaches, though the statute does not make notice to the office mandatory for most businesses.

Other rules may apply depending on your industry. HIPAA covered entities have their own breach notification timeline of 60 days. Non-bank financial businesses covered by the FTC Safeguards Rule, such as auto dealers, mortgage brokers, and tax preparers, must notify the FTC within 30 days of discovering an event involving unencrypted information on 500 or more consumers. See our post on the FTC Safeguards Rule. Because deadlines and definitions are technical, confirm your duties with your attorney.

In the following weeks: close the gaps

Once the fire is out, use the incident to fix how the business works. Most BEC comes down to a few controls:

1. Call-back verification. Any new bank details, urgent wire, gift card request, or payroll change gets confirmed by calling a phone number you already had on file. Never use a number from the email.
2. Dual approval for payments above a set amount.
3. MFA enforced on every mailbox, preferably with phishing-resistant methods such as security keys or passkeys for finance and executive accounts.
4. Alerting on forwarding rules and unusual logins in your email platform.
5. Email authentication (SPF, DKIM, DMARC) on your domain so it is harder to spoof.
6. Training and simulation for the people who move money. Owners, bookkeepers, office managers, and executive assistants are the targets. Practice is what makes people pause when the request feels real. Read how these requests work in our post on executive impersonation.
7. Write down your response plan, including bank fraud line numbers, your insurer’s claims number, and your IT contact, and keep a printed copy.

Quick reference card

Get ready before it happens

Every step above goes faster when you have practiced. High Sierra Cyber runs briefings for owners and finance teams on wire fraud and impersonation scams, along with phishing simulations and awareness training for your whole staff. If you would like help building a one-page response plan, contact us for a free consultation.

This article is general information, not legal advice. Deadlines and recovery outcomes vary. If you are dealing with an active incident, contact your bank, the FBI’s IC3, and your attorney right away.