If you suspect business email compromise (BEC), act in this order:
- If money was sent, call your bank's fraud line immediately and ask for a recall.
- File a complaint at ic3.gov.
- Secure the account: reset the password, revoke sessions, remove attacker MFA methods, inbox rules and app consents.
- Preserve the logs before they age out.
- Bring in incident response, your cyber insurer and legal counsel.
Speed matters most for the money. Banks can sometimes stop or claw back a wire, but only if they hear about it fast.
BEC is one of the costliest cybercrimes reported to the FBI. The FBI's Internet Crime Complaint Center recorded about $2.77 billion in reported BEC losses in 2024 (IC3 Internet Crime Report 2024).
Hour 0โ1: Stop the money
- Call your bank's fraud department (not your relationship manager's email). Give the amount, date, beneficiary account and the receiving bank. Ask them to initiate a recall and contact the receiving bank.
- File a complaint at ic3.gov with the transaction details. For qualifying domestic wires reported quickly, the FBI's Recovery Asset Team can work with banks to try to freeze funds.
- Warn your finance team and any affected vendors or customers by phone: the attacker may still be in the email thread.
Hour 1โ4: Lock the attacker out (Microsoft 365 example)
- Reset the user's password and revoke all sessions and refresh tokens. A password reset alone doesn't end an active session.
- Review registered MFA methods and remove any the attacker added, such as a new phone or authenticator app.
- Check for inbox rules that forward, delete or hide messages (common names: ".", "..", "RSS"). Check mailbox forwarding settings too.
- Review OAuth app consents and remove unknown apps with mail access.
- Check sign-in logs for other accounts accessed from the same IP addresses. BEC rarely stops at one mailbox.
- Enforce MFA for everyone if it isn't already. Block legacy authentication protocols.
The same principles apply in Google Workspace: reset credentials, sign the user out of all sessions, review filters, forwarding, delegates and third-party app access.
Hour 4โ12: Preserve evidence
- Don't delete the mailbox or the attacker's rules. Export them first, then disable them.
- Export the unified audit log, sign-in logs and message trace for the relevant period. Default retention may be shorter than the time the attacker was inside, so export now.
- Save the fraudulent emails with full headers.
- Write a timeline: who noticed what, when, and every action taken.
Hour 12โ24: Scope, notify, decide
- Scope: did the attacker read or export mailboxes containing personal, health or financial data? That determines whether breach-notification laws apply.
- Notify your cyber insurer per the policy. Many policies require prompt notice and approved vendors.
- Engage breach counsel to direct the investigation and protect privilege.
- Bring in DFIR. A professional investigation answers "how did they get in, what did they see, are they gone?" with evidence regulators, insurers and courts accept.
After the first day
- Run a compromise assessment to confirm there's no other persistence.
- Fix the root cause: phishing-resistant MFA for finance and executives, conditional access, advanced email security, and out-of-band verification for any change to payment details.
- Adopt a simple rule: no bank-detail change is ever approved over email alone. Always call back on a known number.
How BEC attacks usually unfold
- Access: a credential-phishing email leads to a fake login page, sometimes one that steals the MFA session token as well.
- Persistence: the attacker adds an inbox rule to hide replies, registers their own MFA method, or grants an OAuth app mailbox access.
- Reconnaissance: they read mail for days or weeks, learning payment cycles, vendors and who approves wires.
- The ask: a reply in a real thread, or from a look-alike domain, with "updated" bank details or an urgent payment request.
- Cash-out: the money moves quickly through mule accounts.
Prevention controls that stop most BEC
| Control | What it stops |
|---|---|
| Phishing-resistant MFA (FIDO2 keys, passkeys) for finance and executives | Credential and session-token theft |
| Conditional access (compliant device, location) | Logins from attacker infrastructure |
| Alerts on new inbox rules, forwarding and MFA changes | Persistence going unnoticed |
| DMARC at enforcement on your domain; look-alike domain monitoring | Spoofing your brand to customers and vendors |
| Call-back verification for payment changes | The fraudulent wire itself |
| 24/7 monitoring of identity and email telemetry | Weeks of undetected attacker presence |
Frequently Asked Questions
Can money lost to BEC be recovered?
Sometimes, if the bank is notified very quickly and funds haven't been moved on. Call your bank's fraud line and file at ic3.gov immediately.
Is changing the password enough after an email account is compromised?
No. You also need to revoke active sessions, remove attacker-added MFA methods, delete malicious inbox rules and forwarding, and review app consents.
Do we have to notify anyone after a BEC incident?
Possibly. If personal or regulated data was accessed, state breach-notification laws or sector rules (such as HIPAA or NYDFS Part 500) may apply. Involve legal counsel.
How do attackers usually get into the mailbox?
Most often through credential phishing, including MFA-bypass phishing kits that steal session tokens, or through reused passwords on accounts without MFA.
Dealing with BEC right now? Call Defensible's 24/7 incident line at (646) 349-4252. Our DFIR team, led by former Stroz Friedberg leaders, works with your bank, insurer and counsel from the first hour. Report an Incident.
