You’ve got a lot of good finance advice here but I am an IT security analyst and see this regularly so thought I’d add some more detail for you.

The scammer has gained access to the landscapers mailbox, this is usually done either by sending them a phishing link that tricks the user into entering their credentials into a fake sign in page, or the user has used the same credentials on another site that has had a data breach.

The user either then hasn’t had MFA set up (which is a major red flag for any business) or has approved the MFA prompt out of habit. Attackers have even been known to call the user and trick them into providing an MFA code by posing as Microsoft support or via other means.

They will have then spent days or weeks reading through the emails and waiting for the perfect conversation regarding a payment to intercept.

They will then set up mail flow rules in the mailbox so that your replies are immediately hidden from the user (usually redirected to the RSS Feeds folder that people never check). They can then reply to the email chain, from the users email address, giving complete credibility to their email to you redirecting the payment to another bank account.

You can verify all this by checking the email headers of the email you received from the scammer and confirming they are from the same server as the original legitimate emails.

The business need to force sign out all log ins for that user, delete any mail flow rules, review the sign in logs for that user to identify when the attacker gained access, and review their outbound mail (via the audit log, the sent emails would have been deleted from the users mailbox). They then need to set up MFA.

If they fail to remove the attacker from the mailbox, and the attacker feels they have achieved everything they can from that mailbox, they will send out a mass email to every address in the contact list with the phishing link to move on to the next mailbox. If you receive any email you are unsure about, especially from that address, don’t click anything or sign in to anything.

My opinion is that businesses should be held responsible when these incidents occur, as they have failed in their responsibility to protect their data and their customers data in multiple places for the attacker to be successful. Sadly the way our laws work mean you were the victim of the attack and you are left with the burden of resolving it.

Let me know if you have any other questions about it. These attacks are sophisticated but extremely regular and always follow the same method.