After a business email compromise: the first 72 hours

When someone breaks into a practice's email, the damage usually shows up as money: a vendor payment sent to the wrong account, a paycheck redirected, a refund issued to a stranger. The first three days decide how much of that money comes back and whether you can ever prove what happened. Much of the evidence you'll need is kept for weeks or months, and some of it for only a week.

Hour one: the money

If a payment has gone out, call your bank's fraud line before you do anything else. Ask them to recall the wire or request return of the ACH payment, and ask what indemnity paperwork they need from you. Then file a complaint at ic3.gov with the full transaction details, whatever the amount.

The FBI's Recovery Asset Team uses those complaints to ask receiving banks to freeze stolen funds. In 2025 it froze about $679 million of the $1.16 billion it was asked to stop, and FinCEN says recovery is most likely when a fraudulent wire is reported within 72 hours. Everything else on this page can wait an hour. That can't.

Lock the account without wiping the evidence

The instinct is to clean up. Document first, then contain.

• Reset the password and sign the user out everywhere. A password change doesn't reliably end sessions that are already open. In Microsoft 365, an admin goes to Users, Active users, the user, the Account tab, and selects Sign out of all sessions. In Google Workspace, reset the password and then the user's sign-in cookies (Directory, Users, the user, Security).
• Check the sign-in methods. Require multi-factor authentication, and remove any phone number or authenticator app the user didn't add. Microsoft's response steps include this review, because an attacker who registers their own method can get back in.
• Record, then remove, what the attacker set up. Look for inbox rules that move, delete or mark messages as read, and for forwarding to outside addresses. Take screenshots or export the list before you change anything.
• Revoke app access. An app the user approved can keep reading mail after the password changes; the FBI warned about this kind of consent phishing in September 2026. Remove any app with mail access that the user doesn't recognize.
• Check who else can open the mailbox. Look for delegates or shared access added recently.
• Warn the people who may have been targeted, by phone: vendors and clients who received messages from the account while it was compromised.
• Leave the attacker's messages and the computer as they are. They're evidence, and you'll need them to work out what was read and what was sent.

Save it before it's gone

Logs are kept for a fixed window, and most small practices run on default settings. Export what you need now, even if you aren't sure you'll use it.

Check that Microsoft 365 auditing was on. Microsoft says auditing isn't turned on by default for Business Basic, Business Standard or Business Premium, the plans most small practices use, and turning it on doesn't recover anything from before. If it was off, the Entra sign-in logs and message trace may be most of what you have.

Also save:

• The suspicious emails themselves, as files (.eml or .msg) with their full headers. Forwarding a message the ordinary way doesn't carry its original headers; if you have to send one to someone, forward it as an attachment.
• The vendor's record in your accounting system, with its change history. In QuickBooks Online, “Online Banking Administration” entries come from your bank connections, and “System Administration” entries come from QuickBooks' automatic processes and from connected apps. Check which apps are connected before you rule those entries out.
• Your own notes: who noticed what, when, and what was done about it, with times.

What to look for

These patterns show up again and again. Any one of them deserves an explanation before you close the incident.

• Rules that hide replies. Inbox rules that move or delete messages containing words like invoice, payment, wire or bank, or the vendor's name, or that file them where nobody looks. Microsoft lists rules that move mail to the Notes, Junk Email or RSS Subscriptions folders as a sign of a compromised account.
• Forwarding nobody set up, on the mailbox itself or through a rule.
• Sign-ins that don't fit: unfamiliar locations, devices or internet providers, especially just before a rule appears.
• Consent to an unfamiliar app with permission to read or send mail.
• Replies going somewhere else: a reply-to address on a lookalike domain.
• In the books: a vendor's bank details changed and a payment to the new account within days, or a refund to an account that hasn't been paid before.

If your Microsoft 365 licenses record the MailItemsAccessed event, it can show which messages were opened (for mail synced to Outlook on a computer, which folders), which matters when you decide whom to notify. Microsoft documents it as on by default for E3 and E5 licenses; on Business plans, have your IT provider check.

Connect-ExchangeOnline
Start-Transcript -Path bec-evidence-log.txt
$FormatEnumerationLimit = -1

# Is the unified audit log on? (True means yes)
Get-AdminAuditLogConfig |
  Format-List UnifiedAuditLogIngestionEnabled

# Every inbox rule, including hidden ones.
# Save this before changing anything.
Get-InboxRule -Mailbox user@contoso.com -IncludeHidden |
  Format-List * | Out-File inbox-rules.txt

# Forwarding set on the mailbox itself
Get-Mailbox -Identity user@contoso.com |
  Format-List Forwarding*Address,DeliverTo*

# Who else can open the mailbox or send as it
Get-EXOMailboxPermission -Identity user@contoso.com
Get-EXORecipientPermission -Identity user@contoso.com

# Rule changes and sign-ins by the account
$ops = "New-InboxRule","Set-InboxRule","Remove-InboxRule",
       "UpdateInboxRules","UserLoggedIn","UserLoginFailed"
Search-UnifiedAuditLog -StartDate "2026-09-01" `
  -EndDate "2026-10-16" -UserIds user@contoso.com `
  -Operations $ops -ResultSize 5000 |
  Export-Csv audit-account.csv -NoTypeInformation

# Forwarding and permission changes on any mailbox, by anyone.
# ObjectId shows the mailbox alias, not the email address.
$ops = "Set-Mailbox","Add-MailboxPermission",
       "Add-RecipientPermission"
Search-UnifiedAuditLog -StartDate "2026-09-01" `
  -EndDate "2026-10-16" -Operations $ops -ResultSize 5000 |
  Export-Csv audit-mailbox-changes.csv -NoTypeInformation

# Mail the account sent (10 days per query, 90 days back)
Get-MessageTraceV2 -SenderAddress user@contoso.com `
  -StartDate "2026-10-06" -EndDate "2026-10-16" -ResultSize 5000 |
  Export-Csv sent-mail.csv -NoTypeInformation

Stop-Transcript

Connect-MgGraph -Scopes User.RevokeSessions.All,Directory.Read.All
Revoke-MgUserSignInSession -UserId user@contoso.com
Get-MgUserOauth2PermissionGrant -UserId user@contoso.com |
  Format-List ClientId,ConsentType,Scope

Line up the inbox with the ledger

This is the accounting side of the investigation. The goal is one timeline that ties every dollar that moved to the message that moved it.

• One clock. Put every event in a single time zone; UTC is easiest. Email headers carry their own time zone offsets. Bank and ledger records often carry only a date, so note which events you can place to the minute and which only to the day.
• One reference per payment. Give each suspect payment a reference (A, B, C) and tag every related record with it: the request, the vendor change in your accounting system, the approval, the bank confirmation and the recall attempt.
• The gap. For each payment, note when the first warning sign appeared and when the money left. That gap tells you which control would have stopped it, and how much time it had to work.
• The loss. Add up what was sent, subtract what came back, and keep direct costs such as investigation, legal and notification on separate lines. Your bank, your insurer and law enforcement will ask for exactly these figures.

Who to tell

• Your bank and the FBI, in hour one.
• Your insurer, promptly. Policies set notice deadlines and often have specific terms for losses like this.
• Patients, if the mailbox held their information. Under HIPAA, unauthorized access to unsecured protected health information is presumed to be a breach unless a documented risk assessment shows a low probability that it was compromised. Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. HHS must be told at the same time when 500 or more people are affected. Smaller breaches go on a log you report to HHS within 60 days after the end of the year.
• The FTC and the IRS, if you prepare tax returns. The FTC Safeguards Rule requires notice to the FTC within 30 days of discovery when unencrypted information of 500 or more consumers is acquired without authorization. The IRS asks tax professionals to report client data theft to their local IRS Stakeholder Liaison.
• Your state, if its data breach law applies to the information involved.

Notification decisions turn on the facts, so bring in your attorney early.

Set this up before you need it

• Turn on Microsoft 365 auditing if you're on a Business plan, and check that it stays on.
• Block automatic forwarding to outside addresses unless you need it. Google Workspace allows it by default; Microsoft 365 has blocked it by default since 2021, except in some older organizations that were already using it.
• Publish SPF, DKIM and DMARC for your domain, and move DMARC to quarantine or reject once your own mail passes. That makes it much harder for criminals to send mail as your exact address, though it does nothing about lookalike domains.
• On Business Premium, block device code sign-in with Conditional Access. The FBI warned in May 2026 that a phishing kit uses it to take over Microsoft 365 accounts despite multi-factor authentication.
• Adopt the callback rule in Verify every payment change.

When to bring in help

If money left, if patient or client information may have been read, or if you can't explain how the attacker got in, bring in an incident response professional before you change more than the steps above. They can collect evidence in a way that holds up. If you want a second set of eyes on the financial side, email me.