A customer receives a payment-instruction change that your finance team never sent. Even if the mailbox still opens, treat this as a possible business email compromise. The urgent risk may be fraudulent payments, hidden forwarding rules or stolen sessions rather than visible spam.
Find out what is actually failing
From a trusted device, alert the authorised administrator and follow your incident procedure. Check account sign-in activity, mailbox delegation, forwarding rules and authentication methods. If a payment request may have been tampered with, verify instructions with the customer through a previously trusted channel.
What a useful investigation should include
Preserve relevant email headers, alerts and audit logs while containing further access. Revoke suspicious sessions and reset credentials through approved processes. Review other affected identities and any linked business applications. If financial transactions are involved, involve your bank and management promptly according to their reporting procedures.
Planning around Sharjah
For Sharjah companies sharing accounts between finance, operations and sales, move away from shared credentials and document who has payment approval authority. Do not send sensitive incident logs or passwords in open chat.
A checklist you can give your IT team
- Verify altered payment requests through an existing trusted phone number.
- Preserve sign-in records and suspicious messages.
- Inspect forwarding rules and delegated mailbox access.
- Revoke sessions and reset authentication through approved channels.
- Check other accounts for the same compromise path.
- Review bank, customer and legal notifications with authorised staff.
Common question
Is changing the email password enough?
Not always. Stolen sessions, app permissions, forwarding rules and compromised devices may remain. Review the account and associated systems as part of containment.
Next step: define the job before accepting a quotation
If the issue is disrupting your work, start with the affected system, the number of people impacted, the last time it worked and any relevant error messages. Confirm whether your team authorises a remote assessment or requires an on-site visit. Ask for written scope, exclusions, data-handling precautions and a way to verify the result.
For more detail, read Cybersecurity services or browse our Sharjah business technology guide. Request a consultation at info@techvenation.ae or WhatsApp our team.
Technical guidance only. The example is illustrative, not a claim about a named customer or completed project. Diagnosis, site attendance and support times are confirmed case by case.