The first 24 hours after you discover fraud, a leak or a breach

Short answer: in the first 24 hours after you discover a fraud, a leak of confidential information or a cyber incident, the priorities are to contain the damage without destroying evidence, preserve data and documents before anyone changes them, keep the circle of people who know small, take legal advice early so the investigation can be protected by privilege, and work out what you are obliged to report and by when.

Contain, but carefully. Stop payments that look wrong, freeze access for accounts that appear compromised and isolate affected systems from the network rather than switching them off or wiping them. Rebuilding a laptop or deleting a suspicious mailbox rule may feel like a fix, but it can remove the only record of what happened and who did it.

Preserve before you investigate. Email, chat, accounting records, access logs, CCTV and phone data are all overwritten or deleted on routine schedules. Suspend automatic deletion where you can, keep copies of logs, and make sure devices used by anyone involved are secured as they are. Forensic images taken early, by someone who can later explain how they were taken, carry far more weight than screenshots.

Do not confront anyone yet. Interviewing a suspected employee, supplier or partner before you understand the facts warns them, invites them to destroy material and can prejudice later disciplinary, civil or criminal action. Decide who needs to know, keep it to that group, and avoid discussing the matter on systems that may be compromised.

Bring in lawyers early. An investigation run at the direction of your solicitors for the purpose of advice or anticipated litigation is more likely to attract legal professional privilege, which can keep the findings confidential. Investigators and forensic specialists instructed through your lawyers can then work inside that protection.

Check your reporting duties. A personal data breach that is likely to put people at risk usually has to be reported to the Information Commissioner's Office within 72 hours of becoming aware of it. Regulated firms may have to tell the FCA or another regulator promptly. Insurers often require early notice under cyber and crime policies, and banks need to hear about fraudulent payments quickly if funds are to be recalled or frozen. Since September 2025, large organisations also need to show they had reasonable procedures to prevent fraud under the Economic Crime and Corporate Transparency Act 2023, so how you respond is part of that story.

Think about the money and the people. Where funds have left the business, early asset tracing and urgent applications to the court, such as freezing or disclosure orders, can make the difference between recovery and loss. Where a person is at risk, through threats, extortion or a stalking campaign, safety comes first and the police should be involved.

Keep a decision log from the first hour: what was found, when, by whom, what was done and why. It will be needed by your lawyers, insurers, regulators and any court, and it protects the people who had to make quick decisions with incomplete facts.

The first conversation with Neel Chakrabarti is free and confidential. Call from a phone you trust and describe what has happened. We will help you decide what to secure, what can wait and who else needs to be involved, and work alongside your lawyers on the investigation, digital forensics and asset tracing that follow. Scope and fees are agreed before any work begins.

Cato & Veil practice note. Legal and regulatory points are general information; take advice from your lawyers on your own situation, and call 999 if anyone is in immediate danger.