Business Email Compromise: How to Respond

Recognise and respond to suspected email compromise

A suspicious payment request, unexplained forwarding rule or unfamiliar account activity can indicate business email compromise. The immediate task is to protect the business while establishing what happened. A convincing email alone does not prove that your own account was accessed: impersonation and supplier compromise are also possible.

Need urgent help? Call CyberXpert on +44 (0)20 4591 7000 for incident support, available 24 hours a day, seven days a week. Use a safe device and contact route where possible.

Check whether payments are at risk

Tell the relevant finance lead about suspicious payment instructions. Verify any change to bank details using an established contact route, rather than a number or reply address supplied in the suspicious message.

If a fraudulent payment may already have been made, contact your bank immediately through its official channel. Ask what action is available and retain the reference. NCSC and Take Five guidance both emphasise contacting the bank when a suspected fraud affects payments. ^[1]^[3]

Keep payment recovery work coordinated with the technical response. Neither team should assume the other has completed the necessary action.

Establish a safe contact and incident lead

Tell your IT or security provider promptly. Identify who can authorise account restrictions and who will coordinate business communication. Do not discuss the investigation through a mailbox that may still be accessible to an attacker.

Write down the account involved, the first suspicious event, affected transactions and any action already taken. Preserve uncertainty. “A supplier received an unusual request” is an observation; it does not yet establish which organisation was compromised.

Contain access through an authorised administrator

For Microsoft 365, the response can involve restricting the affected account, revoking sessions, securing credentials and checking authentication methods. The appropriate steps depend on the identity configuration and evidence. Microsoft also identifies application consent, assigned roles and forwarding settings as areas to review. ^[2]

A password reset alone should not be treated as proof that the incident has ended. Ask the responder to check for other access or persistence and confirm that containment actions have taken effect. Follow current platform guidance and record the changes made.

Other email platforms require their own supported procedures. Avoid applying Microsoft-specific instructions to a different service without checking how that service handles access and sessions.

Preserve and investigate relevant evidence

Keep the suspicious messages, including original message details where available. Do not delete the evidence or forward sensitive material widely. Arrange secure access for the person investigating.

For a Microsoft 365 investigation, relevant sources can include sign-in records, audit events, mailbox rules and message tracing. The affected identity may also have access to files and collaboration services, so the investigation should consider more than the visible email. Availability depends on enabled logging, licences and retention. ^[2]

Ask the responder to distinguish confirmed activity from gaps in the record. The absence of an event in an unavailable log cannot establish that the event did not happen.

Coordinate communication and recovery

Use verified contact details to warn people who need to act on a fraudulent request. Agree the message with the incident lead, finance and relevant advisers. State what is known and what action recipients should take.

Restore routine access through a controlled process. Confirm the user can authenticate safely, review affected workflows and maintain appropriate monitoring. If information may have been accessed or disclosed, assess notification requirements with the relevant privacy, contractual and legal contacts.

Illustrative coordination checklist: finance checks the transaction; the administrator restricts the account; the investigator assesses activity; the incident lead maintains the decision record. One person checks that the actions join up.

Strengthen the affected process

After containment, review the cause and any wider weaknesses. Improvements might involve authentication, administrator access, email configuration or independent verification of payment changes. Agree owners and evidence of completion.

CyberXpert incident response can support investigation and agreed containment. For planned improvement work, explore Microsoft 365 security and our assessment guide.

Business Email Compromise: How to Respond to a Suspected Account Takeover