What business email compromise looks like
Business email compromise (BEC) happens when an attacker gains access to a real mailbox, or convincingly impersonates one, and uses it to steal money or information. Common signs include vendors receiving "updated" payment instructions you did not send, replies to messages nobody remembers writing, or customers asking about strange invoices.
In Microsoft 365, attackers often get in by stealing a password through a phishing page or by capturing a session token that lets them bypass MFA. Once inside, they frequently create mailbox rules that hide their activity, such as moving replies from a vendor into an obscure folder.
Step 1: Contain
The first goal is to stop the attacker without destroying evidence. That usually means resetting the account's password, revoking active sessions so stolen tokens stop working, reviewing MFA methods for anything the attacker added, and removing malicious inbox rules or forwarding after they have been documented.
If money has been sent, contact your bank immediately. The faster a fraudulent transfer is reported, the better the chance of recovery. You can also file a report with the FBI's Internet Crime Complaint Center at ic3.gov.
Step 2: Preserve the evidence
Microsoft 365 keeps detailed logs, but not forever, and retention depends on your licensing. An investigation exports the relevant audit logs, sign-in logs and mailbox data early, before they age out, and records how and when they were collected so the findings hold up later.
Step 3: Reconstruct what happened
With the evidence preserved, the examiner builds a timeline that answers the questions leadership, insurers and attorneys will ask:
- How did they get in? Which sign-in was first, from where, and using what method.
- How long did they have access? From the first malicious sign-in to containment.
- What did they do? Messages read, sent, deleted or forwarded; rules created; files accessed in OneDrive or SharePoint.
- Who else was affected? Other compromised accounts, and contacts who received phishing messages from your domain.
- Was sensitive data exposed? This drives decisions about notification obligations, which your legal counsel will advise on.
Step 4: Report and recover
The investigation ends with a written report that explains the cause, impact and timeline in plain language, with technical detail in the appendices. Recovery then closes the gaps that allowed the compromise, such as phishing-resistant MFA for administrators, conditional access policies, alerts on suspicious inbox rules, and training staff to verify payment changes by phone.
How to reduce your risk now
- Require MFA on every account, and consider phishing-resistant methods for administrators and finance staff.
- Block automatic forwarding of email to outside addresses.
- Make sure Microsoft 365 audit logging is on and retained long enough to investigate.
- Set a firm rule that any change to payment instructions is confirmed by a phone call to a known number.
How Strong Connexions helps
Our incident response is led by an EnCE-certified examiner, and Microsoft 365 compromise is one of the most common cases we handle. If you suspect a compromise, call our urgent line at (801) 947-7111. Learn about our incident response services.
This article is general information, not legal advice. Requirements change; contact us for guidance on your situation.