Skip to content
Corechain Audited
Christopher MichaelMichael Fraud Recovery Advocates · Austin

Case study · Business email compromise

A fake vendor invoice at a construction firm

An invoice with changed bank details looked like it came from a regular steel supplier. The receiving bank returned most of it.

$865,000

Lost

$702,000

Returned

2 days

Evidence pack

§ 01The brief

The firm's accounts payable lead paid an $865,000 progress invoice by wire. The supplier called a week later asking about payment. The email had come from a look-alike domain.

§ 02What I did

  1. 1.

    Put together a timeline and evidence pack with both email headers side by side, in two business days.

  2. 2.

    Filed the CCS report and sent the pack to both banks with the complaint number.

  3. 3.

    Gave the firm a one-page checklist for confirming bank-detail changes by phone in future.

§ 03The outcome

The receiving bank returned $702,000 that had not yet been withdrawn. The firm has had no repeat incidents.

The sooner you call, the more can be done.

The first 30-minute review is free. You'll hear back within 1 business hours, with an honest view of what is realistic.