A payment went to the wrong account. What do we do in the next hour?

Two things run in parallel and neither waits for the other.

The money, immediately: call your bank and request a recall. Then file a report with the FBI's Internet Crime Complaint Center at IC3.gov. There is a federal process for attempting to freeze fraudulently transferred funds, and it works far better inside the first 24 to 72 hours than after. Notify your insurance carrier promptly as well, since late notice is a common reason claims get reduced.

The systems, immediately: call us. Fraudulent payment instructions usually mean a mailbox was compromised, either yours or the other party's. We contain the account, revoke sessions, look for the rules the attacker created, check whether anything else was touched, and preserve the logs before they age out.

Do not reply to the email thread the instructions came from. If it is a compromised counterparty, you are telling the attacker what you have noticed.

Decide in advance who has authority to make these calls at 6pm on a Friday. We set that out during onboarding, because the delay while people work out who can authorize what is exactly the delay that matters here.