Business Email Compromise Checklist: Contain and Preserve in Parallel
Edition 2026-11-03

A diverted payment starts three clocks at once: the bank recall window, the tenant log retention window and the insurer’s notice period. This checklist assigns the bank call, the account containment and the evidence capture to named people who work at the same time, so nobody waits for an export to finish before acting.

Contents

business_email_compromise_checklist.html          The checklist with its guidance, sources and contacts. Open it in any browser or print it.
business_email_compromise_checklist_workbook.csv  The working checklist. Open it in Excel or any spreadsheet and fill in one row per item.

How to use it. Read the checklist page first. Then open the CSV, assign an owner to each row and record the date each action happens. Update the Status column as the work is recorded. In the evidence column, record an evidence ID or the location of your secure repository, where passwords, recovery keys and the evidence itself are kept. When you are ready to begin, call GDF and a senior examiner will walk through the checklist with you.

Talk to a senior examiner. The initial consultation is free. Call (800) 868-8189 at any hour, or write to info@evestigate.com.

© 2026 Global Digital Forensics, Inc. All rights reserved.
