Eric Kuvykin

Reviewed October 17, 2026. This guide replaces an earlier general overview; the original publication date and URL are retained.

When an unexpected payout change or administrator action appears, a reliable timeline helps responders distinguish facts from assumptions. Preserve relevant records while the provider contains the incident.

Activate the response contact before investigating alone

Use the provider’s verified security or emergency channel and the business’s designated response lead. A suspected incident may require immediate containment; evidence collection should not delay stopping an active loss. Follow qualified responder instructions about access, sessions and affected devices. Do not contact an unfamiliar number supplied in the suspicious message or ask ordinary staff to experiment with the compromised account.

Record observations as observations

Open a restricted incident record with the discovery time, observer, affected account reference and what was actually seen. Distinguish an unexpected setting from a confirmed transfer. Record the timezone and whether a timestamp came from the provider, the bank or a staff member’s recollection. CISA recommends protecting logs against unauthorized access or deletion and setting retention according to organizational and compliance needs.

Preserve the before-and-after sequence

For an illustrative payout-destination change, the relevant sequence might include an administrator login, an account-setting change, an approval notification and a subsequent payout reference. Ask the provider to preserve available audit records and explain its retention limits. Keep original exports in a restricted location and record who obtained them. Avoid copying complete payment credentials or unnecessary customer information into email or a shared incident spreadsheet.

Track containment and recovery as separate events

Record when access was restricted, when the provider confirmed the destination and which payment references still need reconciliation. A restored login does not prove that earlier transfers were correct. Have the authorized finance owner compare affected payouts with bank records through the provider’s established process. The handoff should contain verified events, unresolved questions, record locations and named responders, without declaring a cause before evidence supports it.

Sources and related reading

Primary reference: CISA’s logging guidance for small and medium businesses. Worked examples are illustrative analysis, not client results or provider quotes.

Continue with the AMS Florida merchant reading path and merchant technology decision worksheet.