A couple of humble suggestions: 1. Get/Hire someone to do a proper analysis of the "breach". This may require your client's cooperation. 2. Regardless of whos

A couple of humble suggestions: 1. Get/Hire someone to do a proper analysis of the "breach". This may require your client's cooperation. 2. Regardless of whose fault that was, try to improve the process to protect yourself and your clients in the future (e.g. email signing, confirmation via a different channel, different way of collecting payments etc.)