The decision in context.
A fictional supplier-payment incident includes a changed payment instruction, a client-reported transfer and a lookalike sender reference. The reviewed copies support that the payment instruction changed, but not who changed it or who controlled the recipient account. The transfer amount is reported as USD 18,400; bank-confirmed loss and recovery are unknown.
Decision requested
Have the authorized client contact its bank's fraud channel promptly and ask counsel to determine reporting and preservation obligations. Preserve originals before further analysis; avoid contact with the suspected sender.
What was reviewed.
Organize three supplied records, construct a qualified chronology and assess two hypotheses: unauthorized mailbox access versus an external lookalike communication. Authority is limited to client-owned materials voluntarily provided for the fictional matter.
Outside this assessment
Bank account access, tracing private subscribers without lawful process, recovery of funds, actor engagement, payment to intermediaries, seizure, device acquisition and attribution to a real person.
| Asset / record | Owner | Coverage |
|---|---|---|
| AS-01 / Invoice thread | Finance owner | Supplied copies; original message export outstanding |
| AS-02 / Transfer record | Finance owner | Client-reported payment; bank confirmation pending |
| AS-03 / Supplier baseline | Procurement owner | Previous approved payment instruction |
Method and confidence
Define authority and scope; register supplied material; separate direct observations from statements; assess alternative explanations; review limitations; and assign actions with acceptance evidence.
High confidence: cited material directly supports the narrow observation. Moderate: support exists but an important gap remains. Low: a lead or statement needs corroboration. Confidence does not establish identity, intent or legal liability.
Priority reflects potential impact and dependencies, not a CVSS score. High-priority items need prompt attention; medium-priority items need a near-term owner; low-priority items follow the agreed review cycle. All timestamps are UTC.
Findings, with their limits.
Payment destination differs from the approved baseline
- Observation
- The fictional amended instruction and the earlier approved baseline show different masked recipient references.
- Why it matters
- The change is consistent with a payment-diversion scenario and warrants bank-led review.
- Alternative / uncertainty
- A legitimate supplier change remains possible until verified through a previously trusted independent channel.
- Recommended action
- The client should contact its bank and verify the supplier using an established contact, not the details in the disputed message.
- Evidence references
- E-01, E-03
Lookalike sender does not prove mailbox compromise
- Observation
- The supplied screen view shows a near-match sender domain. Full original headers and authorized mailbox logs were not provided.
- Why it matters
- Containment and reporting decisions depend on whether the client's mailbox was accessed or merely imitated.
- Alternative / uncertainty
- Display-name spoofing, forwarding artifacts or a screenshot transcription error could alter interpretation.
- Recommended action
- Request an authorized original message export through the evidence channel and ask the appointed responder to assess mailbox access.
- Evidence references
- E-01
Loss and beneficiary control are not independently established
- Observation
- A supplied transfer screenshot states USD 18,400. It does not establish settlement, recall status, beneficiary identity or ultimate control of funds.
- Why it matters
- Reporting the amount as a confirmed unrecoverable loss would overstate the available evidence.
- Alternative / uncertainty
- The transfer could be held, reversed, misrecorded or legitimately instructed.
- Recommended action
- Record bank-confirmed status separately from the client's account and avoid identity claims without lawful supporting evidence.
- Evidence references
- E-02
Evidence & chronology.
| ID | Source | Received (UTC) | Limitation |
|---|---|---|---|
| E-01 | Fictional changed-instruction screen copy | 2026-10-03 10:10 UTC | Original message and headers missing |
| E-02 | Fictional masked transfer screenshot | 2026-10-03 10:15 UTC | Not a bank attestation; amount is client reported |
| E-03 | Fictional prior supplier instruction | 2026-10-03 11:00 UTC | Supplied baseline; supplier verification pending |
| Event time (UTC) | Event | Source |
|---|---|---|
| 02 Oct / 14:20 | Changed instruction time shown in copy | E-01; source clock unverified |
| 02 Oct / 15:05 | Transfer time displayed in screenshot | E-02; bank confirmation pending |
| 03 Oct / 11:00 | Baseline compared; discrepancy documented | E-03 |
Handling and provenance
These are invented descriptions, not evidence attachments. A live engagement records authority, collector, source, collection and receipt times, method and limitations. Originals stay in approved storage; access, transformations and transfers are logged. Digests, where appropriate, are calculated on actual files.
A screenshot supports what was visible in that copy. It does not establish origin, completeness, authorship or the full history of an event. Client-reported events remain distinct from independently verified observations.
Owners, actions & acceptance.
| When | Owner | Completion evidence | State |
|---|---|---|---|
| Promptly | Authorized finance owner | Contact bank fraud team and retain reference | Client action |
| Before further analysis | Evidence custodian | Preserve original message and supplied files | Open |
| Within agreed scope | Appointed responder | Assess authorized mailbox logs and alternative hypotheses | Referred |
| Before external disclosure | Client counsel | Approve recipients and disclosure basis | Required |
| Hypothesis | Supporting / contrary evidence | What would change assessment |
|---|---|---|
| External impersonation | Near-match sender supports; original unavailable | Original headers and trusted supplier verification |
| Mailbox compromise | No direct access evidence supplied | Authorized identity/mailbox event review |
| Legitimate payment change | Not excluded by copies alone | Independent supplier confirmation and bank record |
These hypotheses are not mutually exclusive. This report identifies evidence gaps, not a suspect or a recovery probability.
Closing an action
Record the actual completion time, responsible person and evidence reference. A recommendation, request or submission is not completion. Keep dependencies visible and agree the next review date.
Limitations & handover.
Copies may omit context or metadata. Timestamp accuracy is not independently verified. This is technical support, not legal advice or a promise of identification, funds recovery or admissibility.
Release checklist for a live engagement
- Approved instruction, scope and authorized assets.
- Named preparer and reviewer, review date and corrections.
- Client decision owner, accepted actions and unresolved objections.
- Approved recipients, secure transfer receipt and acceptance date.
- Next review, retention basis and disposal responsibility.
These fields remain unsigned in this example. No actual approval, instruction or evidence transfer is represented. A live report needs an agreed distribution and retention plan. Real evidence and personal data must not be published in website assets.
Method references
Background guidance only. These publications do not validate fictional findings or certify the report. Apply current platform procedures and engagement-specific legal advice separately.