Business email compromise does not announce itself with a ransom note. It announces itself with a supplier ringing to ask why the bank details changed, or a colleague asking about an email they never sent. By the time you know, the attacker has usually been reading quietly for weeks.
This runbook covers the response to a confirmed or strongly suspected mailbox compromise. Examples reference Microsoft 365 because that is what most mid-market organisations run; the Google Workspace equivalents exist for every step.
How you find out
Worth recognising the common tells, because the report rarely says “we have a BEC”:
- A supplier or customer queries a payment instruction or bank detail change you did not send.
- Staff receive replies to emails they never wrote.
- A user reports rules moving or deleting their mail, or mail they expected simply never arriving.
- Finance is asked, urgently and confidentially, to make a payment that traces back to an email thread.
- Your own phishing report queue contains a mail genuinely sent from a colleague’s account.
Any of these earns immediate investigation of the account in question, not a ticket in next week’s queue.
First hour: lock the account down
Work through these in order for every account you believe is affected.
- Reset the password. Obvious, but it is step one, not the whole job. On its own it does not end the attacker’s access.
- Revoke every active session and token. In Entra ID, revoke sign-in sessions for the user. A live session or OAuth token survives a password reset, and attackers rely on responders not knowing that.
- Check and reset MFA. Look at the registered MFA methods. Attackers who get in often register their own authenticator or phone number so they can walk back in through the front door. Remove anything the user does not recognise, then re-enrol them.
- Hunt the inbox rules. Almost every BEC leaves rules behind: forward to an external address, move replies from finance to RSS Feeds or Deleted Items, mark as read. Check rules created recently across the tenant, not just on the known account.
- Check for delegate access and OAuth grants. Look for new mailbox delegates and recently consented third-party applications with mail access. Both are persistence mechanisms that survive a password reset.
- Block the attacker’s infrastructure where you can see it. Sign-in logs will show the IPs and locations the attacker used. Conditional access can shut down the obvious routes while you work.
Same day: work out what they did and how far it goes
A BEC is rarely one mailbox. The attacker uses the first account to phish the colleagues most likely to trust it.
- Pull the sign-in history for the affected account. Establish the compromise window: first anomalous sign-in to lockout. Everything the account could see in that window is potentially read.
- Search sent items and deleted items for the attacker’s activity. What did they send, to whom, and did they clean up after themselves? Message trace can recover what the mailbox view cannot.
- Check whether internal phishing went out. Search the tenant for mail sent from the compromised account during the window. Every internal recipient who clicked is a candidate second victim; run the first-hour steps on any account that bit.
- Establish what the mailbox contained. Contracts, payroll data, customer personal data, credentials in old emails. This determines whether this is a fraud problem, a data protection problem, or both. If personal data was likely accessed, the regulatory clock is a live question and legal needs to know today.
- Ask finance the direct question. Have any payment instructions, bank detail changes or urgent transfer requests been actioned recently that trace back to email? Do not soften the question. The honest answer decides the next section.
If money moved: the fraud response
Speed matters more here than anywhere else in this runbook. Recovery odds fall steeply within the first day or two of the transfer, and keep falling every day after.
- Call your bank’s fraud line immediately. Ask them to attempt recall and to flag the receiving account. Banks can and do freeze funds that are still sitting in the first hop.
- Report to law enforcement the same day. In the UK that is Action Fraud, and for substantial live transfers ring your bank first and the police second. In the US, the FBI’s IC3 recovery asset team exists for exactly this and works best inside the first 48 hours. Cross-border transfers can sometimes be frozen at the correspondent bank if the report is fast enough.
- Notify the insurer. Crime and cyber policies both potentially respond to BEC losses, and both have notification requirements measured in days.
- Preserve the evidence chain. The full email headers of the fraudulent instruction, the sign-in logs, the rules the attacker created, the payment records. Export and keep them somewhere the incident cannot reach.
- Tell the counterparty the truth. If a customer or supplier paid a fraudulent invoice because your mailbox was compromised, they find out eventually. Hearing it from you today, with your bank and police reference numbers attached, preserves the relationship and their recovery odds. Hearing it from their bank next month does not.
The week after: close the doors properly
- Find the initial access. Usually a phished credential via a fake login page, sometimes password reuse from an unrelated breach, occasionally a legacy protocol with no MFA. If you do not find and fix the way in, the same actor returns within weeks. Their access worked once and they keep notes.
- Kill legacy authentication. If anything in the tenant still allows basic auth, it bypasses MFA entirely and it is how a large share of these begin. Disable it and deal with the one old scanner that breaks.
- Tighten the payment controls that email cannot protect. The permanent fix for BEC fraud is procedural: any new bank detail or changed payment instruction is verified by phone on a number you already hold, never one from the email. Finance signs up to this in writing, and leadership backs them when they hold a payment to check.
- Review conditional access and MFA coverage properly. Every user, every protocol, no exceptions for executives. The most valuable mailboxes to attackers belong to the people most likely to have negotiated an exception.
- Write the two-page summary while it is fresh. Compromise window, what was accessed, what was sent, money moved and recovered, doors closed. This is the document the insurer, the auditor and next year’s tabletop will all ask for.
One-page checklist
Reset password, revoke sessions and tokens, check MFA methods, hunt inbox rules, check delegates and OAuth grants. Establish the compromise window from sign-in logs. Search for internal phishing and treat every caught colleague as a new incident. Assess what the mailbox held; involve legal if personal data is in scope. Ask finance the direct question. If money moved: bank fraud line, police report, insurer, evidence, and tell the counterparty. Then find the way in, kill legacy auth, put phone-back verification around payments, and write it up.
Practitioner Runbooks are working documents, not standards. Spotted something that does not match how it works in your environment? Email hello@incidentresponse.com and we will improve it, credited to you.