Business email compromise response

Business email compromise (BEC) is fraud in which an attacker takes over or imitates a business mailbox and uses it to redirect payments or obtain sensitive information. It is one of the most common serious incidents for organizations of 5 to 200 people. It rarely involves malware. An attacker gets a user's password, usually through a fake Microsoft or Google sign-in page, signs in from somewhere else, and quietly reads mail until there is an invoice, a closing or a payroll change worth intercepting.

The giveaway is usually financial: a supplier says they were never paid, a client wired funds to 'updated' banking details, or a colleague notices replies they never sent. By then the attacker may have had access for days or weeks, and the mailbox often holds client and employee personal information as well.

• Inbox rules that move, delete or forward messages containing words like 'invoice', 'payment' or 'wire'
• Sign-ins from unfamiliar countries, hosting providers or VPN services
• Lookalike domains (one letter changed) inserted into an existing email thread
• New MFA methods or app registrations the user does not recognize
• Phishing sent from the real mailbox to your contacts

Call your bank at once to try to recall the payment. Reset the compromised account's password, revoke its sessions and remove any forwarding or inbox rules the attacker added. Report the fraud to your local police and the Canadian Anti-Fraud Centre, online or at 1-888-495-8501. Preserve mailbox and sign-in logs before cleanup so forensics can show what was accessed.

Do these in order, and write down the time you did each one. Containment should not wipe out the evidence you will need later, so do not delete the mailbox, the rules or the suspicious messages.

1. 01

   Call your bank

   If money moved, call your bank's fraud line immediately and ask them to attempt a recall. Then report to local police and to the Canadian Anti-Fraud Centre, which takes reports online through reportcyberandfraud.canada.ca or by phone. Recovery is never guaranteed and depends heavily on speed.

2. 02

   Reset the password and revoke sessions

   Reset the account password, revoke active sessions and refresh tokens, and review the registered MFA methods. A password change alone does not sign out an attacker who already holds a session token.

3. 03

   Disable malicious rules and forwarding, but record them first

   Screenshot or export inbox rules and forwarding settings before you turn them off. Their names, conditions and creation times are evidence.

4. 04

   Preserve the logs

   Make sure audit logging is on and export what exists. Log retention is limited, so the window to capture it closes on its own.

5. 05

   Warn the people who may be targeted next

   Tell your finance team, and any client or supplier with a pending payment, to verify banking changes by phone using a number they already have on file.

In Microsoft 365 the core evidence is the unified audit log searched through Microsoft Purview Audit, plus Microsoft Entra sign-in and audit logs and the mailbox itself. Microsoft's documentation states that Audit (Standard) keeps records for 180 days for logs generated on or after October 17, 2023; longer retention depends on licensing. In Google Workspace, the equivalent sources are the Admin console's audit and investigation tool and, where the edition supports it, the security investigation tool (see our Google Workspace compromise page).

From those sources we build a timeline that answers specific questions:

If counsel or an insurer is already involved, see forensics for breach counsel and insurers. For first steps on your own, read what to do if a Microsoft 365 account is hacked.

• When did the attacker first sign in, from where, and with what kind of client?
• How did they get in: phished password, MFA fatigue, token theft, or a malicious app consent?
• What did they change: inbox rules, forwarding, delegates, MFA methods, OAuth app grants?
• Which messages and attachments were opened or synced, and over what period?
• Did they send mail from the account, and to whom?
• Was any other account in the tenant touched?

Once the money question is handled, the next question is usually whether personal information was exposed. Under PIPEDA, organizations must report to the Office of the Privacy Commissioner of Canada (OPC) breaches of security safeguards that create a real risk of significant harm, notify affected individuals, and keep a record of every breach, whether or not it is reportable. Provincial laws, including Quebec's and Alberta's private-sector privacy laws, have their own rules.

Forensics does not make the legal call, but it supplies the facts the call depends on. Where mailbox audit records show which items were accessed, we can often narrow the exposure to specific messages and the people named in them. Where logging was limited, the report says so plainly and explains what can and cannot be ruled out. That difference can change how many people need to be notified.

Reports are written to be read by a lawyer, an adjuster and a business owner. Where breach counsel has retained us, we report to counsel and follow their instructions on drafts and distribution.

Most BEC incidents trace back to a short list of gaps. After the investigation we hand over a prioritized fix list, which your own IT team or our Managed IT team can carry out.

• Phishing-resistant MFA for finance and executive accounts, and Conditional Access to block legacy authentication
• Block automatic external forwarding and alert on new inbox rules
• Restrict user consent to third-party apps
• SPF, DKIM and DMARC enforced on your domain so you are harder to impersonate
• A written payment verification procedure: banking changes confirmed by phone, every time
• Audit log retention long enough to answer questions after the fact