What may be examined
Original messages
Full headers and the original message file preserve routing and authentication information that a forwarded screenshot can lose. Attachments and related messages may establish the sequence.
Mailbox activity
Available sign-ins, forwarding rules, delegated access and message traces can help explain how a message was sent or redirected. The account’s retention and permissions define the available history.
Business context
The original invoice, the changed banking request and the timeline of communications provide context. Keep these through an agreed secure channel, separate from the public enquiry form.
Before an examination
Preserve the original emails. If funds were sent, contact the bank immediately through a trusted channel while the authorised incident response proceeds. Record account changes and containment actions; do not wait for a forensic report before taking urgent financial action.
What you can receive
A scoped report can explain the likely message path, observed account changes and evidence supporting or limiting a compromise hypothesis. It can separate spoofing from an authenticated send and identify unanswered questions.
What the evidence may not establish
An IP address, display name or failed SPF check does not identify the offender. Payment recovery and insurer or legal decisions are separate from the technical examination.
Questions before you begin
It helps explain the concern, but preserve the original message with its headers and attachments where possible. The examiner can explain a suitable export method.
No. Contact the financial institution promptly. Technical findings may support a response, but do not guarantee a bank, insurer or legal outcome.