Business email compromise is a race. The attacker is reading your mail, working your vendors, and moving toward a payment. What you do in the first 24 hours decides whether this is a contained incident or a six-figure loss.
Containment first. Every minute the attacker holds the mailbox, they are learning more and getting closer to money movement.
| Action | What It Does | Why It Can't Wait |
|---|---|---|
| Reset & Revoke | Reset the password AND revoke all active sessions and refresh tokens. A reset alone does not kick the attacker out. | Attackers persist through stolen session tokens long after a password change. |
| Kill Mailbox Rules | Review and disable inbox rules: forwarding, auto-delete, and "move to RSS Feeds" style hiding rules. | Rules silently divert the victim's mail so the fraud stays invisible. |
| Re-enroll MFA | Remove registered MFA methods the attacker may have added, then re-enroll the legitimate user. | Attacker-registered authenticators survive password resets. |
| Review OAuth Grants | Check for newly consented applications on the account and revoke anything unrecognized. | Malicious app consents give persistent mailbox access with no login required. |
| Block Known Bad | Block sender domains, lookalike domains, and indicators from the phish that started it. | The same lure is usually running against the rest of your organization. |
Wire recalls are won or lost fast. If a fraudulent payment went out, this happens before anything else.
Contact the bank's fraud department immediately and request a recall / SWIFT recall on the transfer. Speed matters more than paperwork.
File at ic3.gov and request the FBI's Financial Fraud Kill Chain. Most effective within 72 hours for wires over $50,000.
Engage legal counsel and your cyber insurance carrier early. Late notice can jeopardize coverage.
The most expensive BEC mistakes are self-inflicted in the first day.
Once the account is contained, establish what the attacker saw, touched, and set up. This determines your legal obligations and whether the incident is actually over.
| Question | Where the Answer Lives |
|---|---|
| How did they get in? | Original phish, sign-in logs, MFA prompts. Phishing kit, token theft, or password reuse. |
| How long were they in? | Unified audit log and sign-in history, first anomalous login to containment. |
| What did they read or take? | Mailbox audit records: items accessed, searches run, attachments opened, mail forwarded. |
| Who else got the lure? | Message trace across the tenant: same sender, subject, or URL pattern. |
| Is notification required? | Counsel's call, driven by what data was in the mailbox and which regulations apply. |
Log retention is shorter than you think. Export now, analyze later. See Cloud Log Sources That Save Cases.
