Suspected Business Email Compromise? What to do in the first hour

If you suspect Business Email Compromise, call your bank’s fraud department right away if any money may have moved, then secure the affected mailbox without deleting anything and call an incident response team. In the first hour, your priorities are to protect the money, contain the account, preserve the record of what the attacker did and communicate only through channels you trust.

Business Email Compromise (BEC) happens when an attacker uses or impersonates a trusted email account to redirect a payment, change bank details or obtain sensitive information. The messages often look routine, which is exactly why they work.

Quick, careful steps protect your options for stopping a payment and understanding what the attacker did. Hurried steps, such as deleting the mailbox or wiping a laptop, can remove the evidence you will need later. This guide walks through what to do, in order. If you are dealing with a suspected compromise right now, call our 24/7 incident line at 1-650-300-7557 and use this page as a reference while you talk to us. Not a client? Call anyway.

What Business Email Compromise usually looks like

BEC rarely announces itself. Organizations often notice it through a payment question, a confused partner or an odd entry in the mailbox. Common signs include:

• A vendor’s invoice arrives with new bank details, or a request to update payment instructions
• An executive asks for an urgent wire transfer, gift cards or a confidential favor by email
• An employee’s direct deposit details are changed after an email request
• A reply appears in an existing thread from an address that is almost, but not quite, the real one
• Inbox rules you did not create are moving, forwarding or deleting messages
• MFA prompts or sign-in alerts that nobody requested
• Contacts reporting strange messages or attachments that appear to come from you

There are two broad forms. In an account compromise, the attacker has signed in to a real mailbox in your organization. In impersonation, the attacker uses a lookalike domain or a spoofed display name and never touches your systems. Until you know which one you are facing, treat it as an account compromise.

Right away: protect the money

If there is any chance a payment went to the wrong account, this comes before everything else. Banks may be able to act on a fraudulent transfer, and their chances are better the sooner they hear about it.

1. Call your bank’s fraud department. Use the number on your bank’s website or the back of your card, never a number from the suspicious email. Ask them to try to stop or recall the transfer and to contact the receiving bank.
2. Have the details ready. The amount, the date and time, the beneficiary account and bank, and any reference numbers on the transfer.
3. Pause pending payments. Tell your finance team, by phone or in person, to hold any payment or bank-detail change requested by email until it has been verified with a known contact at a known number.
4. Report it to the FBI. The FBI’s Internet Crime Complaint Center (IC3) accepts reports of Business Email Compromise at ic3.gov, and the FBI advises victims to contact their bank and file a complaint as soon as possible. Prompt reporting helps the banks and investigators involved act while funds may still be traceable, although recovery is never certain.

Next: contain the account without destroying evidence

The natural instinct is to delete everything suspicious. Resist it. Inbox rules, sign-in records, sent messages and app permissions are the record of what the attacker did, and they answer important questions later, including whether any sensitive data was accessed.

For a suspected Microsoft 365 or Google Workspace account compromise, these steps are usually appropriate. Work from a device you trust, not the affected user’s computer.

1. Reset the password for the affected account, using a strong, unique password. If the account is actively being misused, an administrator can also block sign-in temporarily while you work.
2. Sign the account out everywhere. Changing a password alone may not end an attacker’s existing session. Administrators can revoke active sessions so every device has to sign in again.
3. Review the MFA methods registered to the account. Attackers sometimes add their own phone or authenticator app. Note anything you do not recognize before removing it.
4. Document, then disable, suspicious inbox rules and forwarding. Take screenshots or record the rule names, conditions and destinations first. Disabling preserves more of the record than deleting.
5. Check for app consents and delegated access. Look for third-party applications granted access to the mailbox and for other users given permission to read or send as the account.
6. Preserve the logs. Some sign-in and audit records are kept for only a limited time, depending on your licensing. Ask your IT team or responder to export or preserve them early.
7. Leave the mailbox and the user’s devices in place. Do not delete the account, purge messages or reimage the computer.

Communicate safely

Assume the attacker can read anything sent from or to the affected mailbox, and possibly others. Plan your communication around that.

• Use the phone, or a separate account and device you know are clean, to coordinate the response
• Tell finance, executives and anyone who approves payments directly, not by email
• If fraudulent messages went to customers or vendors, warn the key contacts by phone using numbers you already have on file
• Do not announce the incident through the compromised account or in the same email threads
• Keep a simple written log of what you noticed, when, and every action taken

Bring in the right people

BEC is a technical, financial and sometimes legal event at the same time. Within the first hour, line up the people who will need to make decisions.

• Your cyber insurer. Many policies set notice requirements, and some assign a response firm. Contact the claims line early and follow the carrier’s process.
• Your legal counsel. Whether you have notification obligations, under state breach-notification laws or your contracts, depends on what data was accessed. That is a question for counsel, supported by technical findings. Counsel can also advise on reporting beyond IC3, such as to CISA at cisa.gov/report.
• Your IT team or IT provider. They know your environment and can help carry out containment steps.
• An incident response team. Our in-house team can investigate the mailbox, sign-in activity and connected systems. When you authorize it, we coordinate with your counsel and insurer, and if your insurer assigns a response firm, we work alongside that firm where your policy permits. Learn more about our incident response and DFIR services.

What not to do

• Do not reply to the attacker or continue the suspicious thread
• Do not send a small “test” payment or try to negotiate
• Do not delete the mailbox, messages or rules before they are documented
• Do not wipe or reimage the affected user’s computer
• Do not send passwords, screenshots containing sensitive data, or evidence files to anyone by email or chat
• Do not assume only one account is affected

After the first hour: what an investigation answers

Once the account is contained and the bank has been contacted, the next phase is understanding the full picture. A proper investigation typically establishes:

• How the attacker gained access, such as a phishing page, a reused password, repeated MFA prompts or a stolen session
• What the attacker read, sent, changed or downloaded, and over what period
• Whether other accounts were targeted or compromised
• Whether sensitive data was accessed, which matters for any notification decisions your counsel makes
• Which controls failed or were missing, and what to change

Our forensic investigation is performed in-house, with documented evidence handling and chain of custody. The goal is a clear, documented timeline that supports decisions by your leadership, counsel and insurer, not guesswork.

Our page on Business Email Compromise and wire fraud response explains the full engagement: how we contain the account, find out what happened, work with your insurer and counsel when you authorize it, help you restore normal operations and prevent a repeat.

Reduce the chance of a repeat

BEC succeeds when a stolen password or a convincing message is enough to move money. The most effective defenses combine technical controls with simple business processes.

• Stronger sign-in protection. Require MFA for everyone and use phishing-resistant methods for finance and admin roles. Our Microsoft 365 security baseline covers this in detail.
• Block automatic external forwarding and alert on new inbox rules and forwarding changes.
• Watch for suspicious sign-ins around the clock. Managed detection and response from our in-house 24/7 SOC can catch account takeover activity outside business hours.
• Email authentication. SPF, DKIM and DMARC make it harder for attackers to spoof your domain, although they do not stop lookalike domains. Atlantic Computer Systems, our parent company, can help set these up as part of its managed cybersecurity services.
• A payment verification rule. Any change to bank details, or any unusual payment request, is confirmed by calling a known contact at a known number, with a second approver for large or unusual transfers.
• Practical training. Security awareness training that includes BEC and executive impersonation scenarios helps staff pause before acting on urgent requests.

Get help when you need it

If you suspect Business Email Compromise right now, call our 24/7 incident line at 1-650-300-7557 or visit Active Incident Support for first steps. Our step-by-step guide for a suspected compromise covers the wider first actions, and our warning signs and self-check helps if you are not sure yet. If you want to strengthen your email and payment controls before anything happens, book a free 30-minute consultation with our security team.