Business email compromise (BEC): detecting a hacked mailbox and stopping payment fraud

The short answer: business email compromise, or BEC, is not just a phishing email. It is a real mailbox, yours or a supplier’s, taken over by a fraudster who reads conversations for days, waits for an invoice or a payment, then slips in new bank details or an urgent request at the right moment. The message comes from a legitimate address, inside a real thread: no spam filter will block it. Three things genuinely protect you: spotting the signs of a compromised mailbox early, knowing how to secure it completely, and enforcing a payment procedure that never depends on an email.

This article complements our overview of the email scams targeting SMBs in Morocco. Where that piece describes the scenarios, here we detail what happens inside the compromised mailbox and the technical steps to take back control. The steps quoted come from Microsoft’s official documentation and from the recommendations published by the FBI on this type of fraud.

How business email compromise unfolds

The scenario almost always follows the same stages:

1. Credential theft. A fake Microsoft 365 or Google sign-in page, received by email, captures the password. The most recent kits also capture the active session, which bypasses MFA by SMS or push notification.
2. Quiet set-up. The fraudster signs in and creates an inbox rule: messages containing “invoice”, “transfer” or “bank details” are moved to a rarely checked folder, or forwarded to an external address. They may also add their own MFA method or consent to an application to keep access.
3. Observation. For days, they read exchanges with customers and suppliers, noting expected amounts, due dates, tone and signatures.
4. The strike. When a payment is due, they reply in the existing thread: “Following a change of bank, please use these details from now on.” Replies from the real person are hidden by the rule created in stage 2.
5. Propagation. The compromised mailbox is then used to send malicious links to contacts, creating new victims among your customers and partners.

There are two variants. Either your mailbox is compromised, and your customers receive fake bank details in your name. Or your supplier’s mailbox is, and you receive fake bank details from them, sent from their real address. In both cases, the technical protection of your own email is not enough: the payment procedure is the last barrier.

The signs of a compromised mailbox

Microsoft lists the typical symptoms of a compromised Microsoft 365 account in its documentation. Here they are, with what they mean in practice:

Observed sign	What it may hide
Unknown inbox rules forwarding to an external address	The fraudster gets a copy of every exchange
Rules moving messages to “Notes”, “Junk Email” or “RSS Subscriptions”	Replies from customers or suppliers are hidden from the user
Unknown messages in “Sent Items” or “Deleted Items”	The fraudster wrote in your name, then erased the traces
External forwarding recently added to the mailbox	Persistence set up by the attacker
Altered signature, changed details in the directory	Preparation for a credible impersonation
Unexplained password changes or lockouts	Repeated access attempts
Mailbox blocked from sending	The mailbox was used to send spam or phishing in bulk

Other signals come from outside: a customer asking “have you really changed banks?”, a supplier chasing an invoice that was already paid, or contacts reporting a strange email sent from your address. Such calls must trigger an immediate check, not just a reassuring reply.

First steps: securing the mailbox

Microsoft stresses one point: the fraudster tries to keep access through several means, and every step must be addressed. Changing the password alone often leaves the door open. Here is the order we follow, in line with the procedure Microsoft publishes for Microsoft 365.

1. Block the account during the investigation

Microsoft recommends disabling the account while you investigate. Failing that, reset the password with a strong, unique one, never sending it to the user by email, since the attacker may still be reading the mailbox. If the account is synced from an on-premises Active Directory, the password is changed there, and Microsoft advises resetting it twice. App passwords are not revoked automatically: they must be deleted.

2. Revoke every active session

A changed password does not necessarily invalidate a session the fraudster already has open. Revoking sessions (the Revoke-MgUserSignInSession command in Microsoft Graph PowerShell, or the equivalent action in the Entra admin centre) invalidates existing tokens and forces a fresh sign-in everywhere.

3. Check MFA methods, applications and roles

• Registered MFA methods: remove any phone or authenticator app the user does not recognise.
• Applications consented by the user: revoke anything that does not belong; a malicious app can read mail without a password.
• Admin roles: make sure no role has been added to the account.

4. Remove hidden rules and forwarding

In Exchange Online PowerShell, two commands show the real state of the mailbox:

• Get-Mailbox -Identity <mailbox> | Format-List Forwarding*Address,DeliverTo* shows any forwarding configured directly on the mailbox.
• Get-InboxRule -Mailbox <mailbox> -IncludeHidden lists every inbox rule, including those that do not appear in Outlook.

Any rule that forwards, redirects or moves messages for no known reason is deleted, after being recorded in the incident log.

5. Investigate what happened

Entra ID sign-in logs (IP address, country, time, success or failure) show how long the attacker was present. The Microsoft Defender portal audit log and message trace show what was read, sent or deleted during that period. This step is essential to know which customers or suppliers to warn: if fake bank details went out in your name, every recipient must be alerted by phone.

On Google Workspace, the logic is the same: sign the user out of all sessions, change the password, check forwarding addresses, Gmail filters, delegations and authorised third-party apps, then review the audit logs in the admin console.

These steps fit into a wider framework, described in our article on the incident response plan and the first hour of a cyberattack.

If a transfer has already been made

The FBI, which has tracked this type of fraud for years, recommends contacting your bank immediately and asking it to reach the bank that received the funds. Every hour counts. In parallel:

• Delete nothing: keep the fraudulent messages with their full headers, statements and exchanges with the bank.
• File a complaint with the authorities, with the evidence you kept.
• Warn the partner concerned by phone, on a known number: their own mailbox may be compromised.
• Handle the mailbox as an incident following the steps above, even if the problem seems to come from outside.

Technical settings that reduce the risk

No setting fully prevents a compromise, but several make credential theft harder and fraud more visible:

Setting	Effect	Where to configure it
MFA for everyone, phishing-resistant for sensitive accounts	A stolen password is no longer enough	Entra ID, Google admin console
Block automatic forwarding to external recipients	Forwarding rules created by a fraudster fail	Outbound spam policy (Microsoft 365), Gmail settings
SPF, DKIM and DMARC in strict mode	Third parties can no longer spoof your domain	Domain DNS zone
Alerts on new forwarding rules and unusual sign-ins	Detection within minutes rather than weeks	Microsoft Defender, Google Alert Center, monitoring
“External sender” banner on incoming mail	A fake executive writing from outside becomes visible	Mail flow rules
Conditional access (countries, managed devices)	A sign-in from an unknown device is blocked	Entra ID

On forwarding, Microsoft recommends not leaving the default “Automatic - System-controlled” setting, whose behaviour varies with the age of the tenant, and explicitly choosing “Off”, with targeted exceptions where forwarding is genuinely needed. The auto-forwarded messages report shows which mailboxes already forward externally.

These settings are covered in our guides on 10 settings to secure Microsoft 365, rolling out MFA in a company and SPF, DKIM and DMARC.

The payment procedure: the barrier the fraudster cannot cross

The fraudster controls a mailbox; they control neither your landline nor the second person who approves a payment. The FBI’s recommendations come down to a few rules, which we advise writing on a single page signed off by management:

1. Any change of a supplier’s bank details is confirmed by phone, using the number already on file, never the one given in the message.
2. Any transfer above the threshold you set requires dual approval by two different people.
3. No transfer is made on the strength of an email alone, whatever the urgency and whoever the sender, management included.
4. Urgency and secrecy requested in a message are treated as warning signs, not reasons to speed up.
5. Look-alike domains (one letter changed, a hyphen added) are checked: the FBI even advises registering close variants of your own domain name.
6. Your customers are told that you will never change bank details by email alone, for example with a note on your invoices.

This procedure protects you in both variants, whether the compromised mailbox is yours or your supplier’s. Finance teams must know it and practise it: our phishing awareness programmes include fake bank detail change scenarios.

The mistakes we see most often

• Changing the password without revoking sessions or checking mailbox rules: the fraudster keeps access.
• Deleting fraudulent messages “to clean up” before investigating: the evidence disappears.
• Confirming new bank details by replying to the email received: the fraudster is the one who answers.
• Assuming SMS-based MFA is enough: recent phishing kits capture the session too.
• Not warning customers and suppliers after a compromise: they become the next victims.

How we support businesses

We start with the free initial audit: Microsoft 365 or Google Workspace configuration, MFA, external forwarding, SPF, DKIM and DMARC records, account permissions and payment procedures. We then fix the settings, as a Microsoft partner and Google Workspace partner, and draft the payment approval procedure with you.

As part of our business cybersecurity services in Morocco, 24/7 monitoring watches for unusual sign-ins and new forwarding rules, and a critical incident, such as a compromised mailbox, is handled in under 15 minutes. Request your free initial audit: we reply within 24 business hours.