The payment has already gone

The only playbook here where the first hour is about money rather than evidence. Recall has a window measured in hours and it closes whether or not your investigation is finished, so the two run in parallel from the first minute.

Trigger. A supplier says they never received it, or a bank detail change turns out to be fraudulent.

The first 90 minutes1 of 5 expire

01 02 03 04 05

045 min90

01
Call your bank and say the words fraudulent payment
by 15 minexpires
By phone, not email, and now. Recall depends on the receiving bank freezing the funds before they are moved on, which is a race. Note the time of the call and who you spoke to.
02
Report it to law enforcement while the trail is warm
by 30 min
In the United States this is IC3, and the report is what allows the Financial Fraud Kill Chain to be invoked on qualifying international wires. Elsewhere use the national fraud reporting route. This is not paperwork for later; it is part of the recall mechanism.

Tell somebody

Finance and the bank, in the first fifteen minutes, before any technical work
Law enforcement, because recall on international wires can depend on it
Insurers, whose policy usually has a notification deadline shorter than you expect
The supplier, by phone on a number from the contract, once you know which side to ask about

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Call your bank and say the words fraudulent payment

Report it to law enforcement while the trail is warm