Business email compromise: warning signs and first response steps

What business email compromise looks like

Business email compromise is fraud carried out through email that appears to come from someone you trust: a supplier, a director, a customer, your own finance team. The usual goal is payment diversion fraud, where you are persuaded to send money to a new bank account, though the same access is also used to steal data.

There are two quite different ways it happens, and the response depends on which one you are facing. In the first, the attacker never touches your systems. They write from a lookalike domain (one character different from the real one) or forge the sender name, which is called spoofing. In the second, they have signed in to a real mailbox, yours or your supplier's, and write from inside it. That version is harder to spot because the message comes from a genuine address, sometimes as a reply in a real conversation.

You cannot tell which one you have by reading the email alone. Treat the request as suspect either way, deal with the money first, then let an administrator establish whether one of your own mailboxes is involved.

Warning signs in the request itself

Anyone in the business can check these, and none of them needs technical access. One on its own is not proof, but a request that combines several deserves a phone call before anything else happens.

• New or changed bank details for a supplier you already pay, especially when the email arrives close to an invoice due date.
• Pressure to act today, to keep the matter confidential or to skip the usual approval.
• A sender address or domain that is almost right. Read the full address, not just the display name.
• A reluctance or refusal to talk by phone, or a suggestion that the usual contact is unavailable.
• An instruction from a senior person to buy gift cards or make an urgent transfer, particularly when they are said to be travelling or in a meeting.
• Requests for payments you did not authorise, or strange emails reported as coming from your own domain. The NCSC lists both among the signs that something has gone wrong.

If money may have been sent: the first hour

Do these in this order. The bank call comes first because every hour reduces the chance of stopping or recalling a transfer, and the bank can only act on what it is told. No one can promise a payment will come back, but a delayed call makes it less likely.

1. Stop any payment that has been approved but not released, and hold related invoices until the details are confirmed.
2. Phone your bank using the number on your bank card, statement or official website, never a number from the suspicious email. Give them the amount, date, receiving account details and the fact that you suspect fraud. Ask what they can do to stop or recall the payment and whether any reimbursement rules might apply to you. Eligibility depends on the type of organisation and the payment method, so ask rather than assume.
3. Phone the genuine supplier or colleague on a number you already had from before the email. Do not use the contact details in the message. Ask whether they sent the request. If the answer is no, their own mailbox may be compromised too, which is worth telling them.
4. Do not reply to the suspicious email or tell the sender you are onto them. If a mailbox is genuinely compromised, the attacker may read your reply and delete evidence or move faster.
5. Keep the evidence. Leave the original messages where they are, with full headers available, and note times, amounts and account details. Do not delete anything from the mailbox yet, and do not forward the message around internally in a way that creates confusion about which copy is the original.
6. Tell whoever looks after your IT, and your cyber insurer if you have one, as soon as you can. Some policies ask for prompt notification, so check yours.

Spoofed or genuinely compromised: what an administrator can check

This section is for someone with administrator rights in Microsoft 365. Everything here only reads information, so it is safe to do before any containment. The aim is to find out whether a real mailbox has been signed in to by someone who should not be there.

Microsoft lists these symptoms of a compromised mailbox: missing or deleted email, inbox rules that forward messages to unknown addresses or move them into folders such as Notes, Junk Email or RSS Subscriptions, odd messages in Sent Items or Deleted Items ("I'm stuck in London, send money" is Microsoft's own example), newly added external forwarding, unexplained password changes or lockouts and changes to the person's entry in the address book. Any of them on the mailbox named in the fraudulent email moves this from 'someone is faking us' to 'someone is inside'.

The PowerShell steps below need the Exchange Online PowerShell module and an account that can view mailbox settings. Replace YOUR_USER_UPN with the user's UPN (user principal name), the sign-in name that normally looks like their email address.

1. Look for the suspicious message in the sender's Sent Items and Deleted Items, then search for it in message trace in the Microsoft Defender portal. A message that really left your tenant shows up in message trace even if the attacker has since deleted it from the mailbox. If your own users' addresses appear as the sender but nothing was sent from your tenant, spoofing becomes the likelier explanation. That is our reading rather than a guarantee, so keep going with the other checks.
2. In the Microsoft Entra admin centre, open the sign-in logs for the user and look at IP address, location, time and whether each sign-in succeeded. Microsoft advises reviewing activity from just before the first suspicious event through to the end of your clean-up. You are looking for successful sign-ins from places or times that the person cannot explain.
3. Connect to Exchange Online PowerShell. A sign-in window will appear and you will need to authenticate as an administrator.
   powershellCopy

   Connect-ExchangeOnline

4. Check whether the mailbox forwards mail. A value in ForwardingSmtpAddress means mail is going to an external address and a value in ForwardingAddress means it is going to an internal recipient. Write down what you see before changing anything.
   powershellCopy

   Get-Mailbox -Identity YOUR_USER_UPN | Format-List Forwarding*Address,DeliverTo*

5. List the inbox rules, including hidden ones, and look for any that redirect or forward mail, or that delete or move messages. Note the Identity value of anything suspicious. Rule names such as a single character are worth a second look.
   powershellCopy

   Get-InboxRule -Mailbox YOUR_USER_UPN -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity

6. Your result tells you which branch to follow. Nothing unusual in sign-ins, rules or forwarding fits a spoof or lookalike: stay on the money and reporting steps and consider whether the supplier's side was compromised. Anything unexplained points to account takeover, so continue to the next section.

Containing a compromised mailbox

These actions are disruptive. The user will be locked out of Microsoft 365 entirely and signed out of every device until you restore access, so tell them by phone or in person. Do not send a replacement password by email, because the attacker may be reading that mailbox. You need rights to manage users in Microsoft Entra ID, plus Exchange Online PowerShell for the mail settings. Rollback for the lockout is simply re-enabling the account once the steps are complete, as the last step shows.

A password reset alone is not enough. Stolen sessions can keep working, and attackers often leave extra ways back in, such as another MFA method, an app with consent to the mailbox or an admin role. The sequence below closes those in order.

This is deliberately the short version for a suspected BEC case. If the mailbox was also blocked from sending, the restricted sender fix in our other Field Note covers lifting that restriction after the account is secure.

1. Disable the account while you investigate. Microsoft's preferred option is to disable it rather than only reset the password. Run the lookup and the disable together, replacing YOUR_USER_UPN with the user's UPN. This needs the Microsoft Graph PowerShell module and permission to update users.
   powershellCopy

   Connect-MgGraph -Scopes "User.ReadWrite.All"
   $user = Get-MgUser -Search UserPrincipalName:'YOUR_USER_UPN' -ConsistencyLevel Eventual
   Update-MgUser -UserId $user.Id -AccountEnabled $false

2. Revoke the active sign-in sessions so that tokens the attacker already holds stop working. This needs the Microsoft.Graph.Authentication and Microsoft.Graph.Users.Actions modules. The genuine user will have to sign in again on every device later.
   powershellCopy

   Connect-MgGraph -Scopes User.RevokeSessions.All
   Revoke-MgUserSignInSession -UserId YOUR_USER_UPN

3. In Microsoft Entra ID, review the user's registered authentication methods and devices, the applications they have consented to, and any administrative roles assigned to them. Remove anything you do not recognise. If you are not sure whether a method or app is genuine, ask the user by phone.
4. Remove the attacker's mail settings, having noted them first in the previous section. This clears forwarding on the mailbox. If you find a suspicious inbox rule, remove it by its Identity value. If the user had a legitimate forwarding setup before, restore it from your notes afterwards.
   powershellCopy

   Set-Mailbox -Identity YOUR_USER_UPN -ForwardingSmtpAddress $null -ForwardingAddress $null

   powershellCopy

   Remove-InboxRule -Mailbox YOUR_USER_UPN -Identity "YOUR_RULE_IDENTITY"

5. Reset the password and set it through a channel the attacker cannot see. If the account syncs from on-premises Active Directory, reset it there; Microsoft advises doing so twice. If the account is federated, change it in the on-premises environment. Ask the user to delete and recreate any app passwords, because a password reset does not revoke them. Make sure multifactor authentication (MFA) is required for the account before it is used again, since a password alone is what failed.
6. Re-enable the account only when the steps above are complete. Run this in a session where you can look the user up again, replacing YOUR_USER_UPN. Then ask the user to sign in and watch the sign-in log for the first successful sign-in from their normal location.
   powershellCopy

   Connect-MgGraph -Scopes "User.ReadWrite.All"
   $user = Get-MgUser -Search UserPrincipalName:'YOUR_USER_UPN' -ConsistencyLevel Eventual
   Update-MgUser -UserId $user.Id -AccountEnabled $true

Who to tell and what to report

Contact the people whose details were used or who may have received fraudulent messages from the account. Microsoft notes that attackers use compromised mailboxes to send to recipients inside and outside the organisation, so check message trace for who actually received what and warn them by phone not to act on it. If a supplier's or customer's own mailbox looks to be the source, they need to know quickly.

Report the crime. Report Fraud, run by City of London Police, replaced Action Fraud on 4 December 2025 and takes reports at reportfraud.police.uk or on 0300 123 2040 for England, Wales and Northern Ireland. In Scotland, report to Police Scotland on 101. Your bank is not a substitute for this; do both.

Consider the Information Commissioner's Office (ICO). If the attacker could read mailboxes containing personal data about customers or staff, you may have a legal duty to report, and the NCSC points small organisations to the ICO to check which incidents qualify. Do not leave that decision until the clean-up is finished.

Confirming it has stopped

Run the forwarding and inbox rule checks again and expect nothing suspicious. Over the following days watch the sign-in log for successful sign-ins from unfamiliar locations, and message trace for outgoing mail the user did not send. A new rule or sign-in from somewhere unexpected after you have revoked sessions means something was missed, most often an app consent, a spare MFA method or a second mailbox.

On the money side, treat every change of bank details, from any supplier, as unverified until someone has confirmed it by phone on a number from before the incident. That habit is the only check that works whichever way the attacker got in.

When to hand it to a specialist

Bring in experienced help if an administrator account may be involved, more than one mailbox shows suspicious activity, the account syncs or federates with on-premises systems you do not control, a large payment has gone and you cannot say what the attacker saw, or the logs do not cover the period you need. The steps above are written for Microsoft 365. On another mail platform the principles carry over (stop the money, verify by phone, find and remove forwarding, replace credentials), but the commands and screens will differ.