Business Email Compromise (BEC) Recovery

A convincing fake login page harvests the password, often defeating any sense of “we would never fall for that” because the page is a pixel-perfect copy of your real sign-in. Once the attacker has the password, the mailbox is open unless multi-factor authentication stands in the way.

A password leaked from an unrelated breach gets tried against your email, and if a staff member reused it, the attacker walks straight in. This is why a single reused password on a personal site can end up costing a company a five-figure invoice fraud.

Where multi-factor authentication exists but is weak, attackers use real-time phishing kits that relay the code, or wear the victim down with repeated push prompts until they approve one out of fatigue. Part of recovery is closing that gap, not just resetting the password the attacker already used.

We confirm the compromise, identify which accounts are affected, and check whether money is currently in motion. If a fraudulent payment is in flight, that becomes the first priority alongside containment, because a bank recall has a short window.

We force a password reset, revoke every active session and token so the attacker’s logged-in browser dies, and enforce strong multi-factor authentication. Resetting the password alone is not enough, because an existing session or an app token can keep the attacker inside after the password changes.

We hunt for everything the attacker set up to stay in and stay hidden. That means malicious inbox rules that auto-delete or forward mail, secret forwarding addresses, added mailbox delegates, rogue OAuth application grants, and enrolled devices. These are the mechanisms that let an attacker keep reading your mail long after you think you have kicked them out.

The hidden forwarding trick

A common move is a rule that quietly forwards a copy of every incoming message to an outside address, or one that deletes replies containing words like “invoice” or “payment” so the victim never sees the counterparty’s questions. We find and remove these, then check the audit logs to see how long they were running.

We restore normal, secure access for the legitimate user, verify the mailbox is clean, and work with you on communicating with affected suppliers or customers. Where a fraudulent message went out under your name, a prompt, honest correction to the recipients often prevents a second victim.

We close the door properly: enforced phishing-resistant MFA, tightened mail-flow rules, blocked legacy authentication protocols that skip MFA, and alerting on suspicious inbox-rule changes. We also review the wider tenant, because an attacker who reached one mailbox often tried the others.

We trace the messages the attacker sent, the invoices they altered or forged, and any request to change supplier bank details. If a payment has already gone out, speed matters, and we help you push your bank for a recall while the funds may still be reachable.

BEC often uses your mailbox to defraud your customers and suppliers, not you directly. Identifying who the attacker contacted, and warning them quickly, stops your compromise turning into their loss and protects the relationship.

Preserving evidence for the bank and police

We preserve the mailbox audit logs, the malicious rules and the fraudulent messages to a standard that supports a bank dispute, an insurance claim or a police report. Cleaning up carelessly can destroy exactly the evidence you need to recover the money.

While the attacker retains access they see your replies, learn your processes, and refine the con. Cutting access quickly does not just stop the current fraud, it denies them the intelligence to run a better one next week.

If money has moved to a mule account, the funds are often withdrawn or moved on within hours. A fast, evidenced request to your bank, with the fraudulent messages preserved, gives you the best chance of a recall before the trail goes cold.

A written account of how the attacker got in, what they could access, which rules and grants they left behind, and what fraudulent messages went out. It supports your GDPR assessment, your insurance claim and any bank dispute.

A prioritised list of the changes that close the gap the attacker used, and a free retest once you have applied them so you can confirm the mailbox and the tenant are genuinely locked down.

Under GDPR Article 33, a breach likely to risk people’s rights must be notified to the supervisory authority within 72 hours of you becoming aware of it. A compromised mailbox that held personal correspondence, attachments or contact data will often meet that bar. We establish what the attacker could actually access, and over what period, so your data protection officer can make the call on solid facts.

Where the exposure is likely to be high risk to individuals, Article 34 may require you to tell them directly. This matters especially when the mailbox held sensitive data or when the attacker used it to target the very people whose data was inside. We provide the technical scope; your counsel decides the response.