Business Email Compromise: Investigation and Response Playbook

Most BEC cases reach the security team through one of four channels: a user reports a suspicious password reset prompt, a finance team member notices a vendor reporting non-receipt of payment, a counterparty's security team notifies you that they received a phishing email from your domain, or an EDR/email security alert fires on anomalous OAuth consent. Within 30 minutes of notification, validate three things. First, check the mailbox for inbox rules using Get-InboxRule -Mailbox user@domain.com | Where-Object {$_.Enabled -eq $true}; attackers typically create rules that move mail from finance, banking, or specific vendor domains to RSS Subscriptions, Conversation History, or a hidden folder, and mark as read. Second, check for OAuth app consent in Entra ID via the Enterprise Applications blade, filtered to the user as actor; look for unfamiliar apps with Mail.Read, Mail.ReadWrite, or Mail.Send permissions, especially those granted in the last 90 days. Third, check forwarding: Get-Mailbox user@domain.com | Select ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward. Any external forwarding address (especially personal Gmail, ProtonMail, or a lookalike domain) is high confidence BEC. If any of the three are positive, escalate to incident.

Open the Microsoft Purview compliance portal and run an audit search for the compromised UPN over the maximum retention window. The high-value record types are AzureActiveDirectoryStsLogon (sign-in events including IP and user agent), ExchangeItem (mailbox operations including New-InboxRule, Set-InboxRule, Set-Mailbox), MailItemsAccessed (which mail was read; requires E5 or the Microsoft 365 Audit add-on), MessageSent (which mail was sent from the account), and consent grants under AzureActiveDirectoryAccountLogon. Export the results to CSV and pivot on ClientIP to identify attacker infrastructure; legitimate users typically sign in from a small set of IPs while attackers will appear from VPS providers, residential proxies, or anonymizers. The Connect-ExchangeOnline PowerShell module is required for some queries that the GUI does not expose; use Search-UnifiedAuditLog -StartDate -EndDate -UserIds -RecordType ExchangeItem -ResultSize 5000 in scripted batches. MailItemsAccessed reports message bind operations and is the primary evidence for what the attacker actually read; correlate the InternetMessageId values in the audit record back to the message subject and recipient list to scope sensitive content exposure.

Three blast radius questions need answers within the first 4 hours. First: who received email from the compromised account during the dwell period? Run Search-UnifiedAuditLog -RecordType ExchangeItem with Operations = Send and harvest the recipient list. Cross-reference with your DLP and email security gateway logs for the same window to catch outbound emails that bypassed audit log capture. Second: who clicked links in mail sent from the account? If you have Microsoft Defender for Office 365, query UrlClickEvents for the compromised sender. Otherwise, query your secure web gateway or DNS logs for traffic from internal IPs to URLs you can extract from the sent messages. Third: what was the attacker reading? Pivot MailItemsAccessed by InternetMessageId, then look up each message in the user's mailbox (still preserved via litigation hold or eDiscovery search) to determine sensitivity. Build a list of categories: wire instructions in flight, contracts under negotiation, personally identifiable information in attachments, intellectual property. This list drives the regulatory and counterparty notification decisions later.

If the BEC involved a fraudulent wire or ACH, the clock is your enemy. Within the first 2 hours, contact your finance team's banking liaison and request a SWIFT recall (for international wires) or a Hold/Reversal for domestic ACH. Provide the originating account, beneficiary account, amount, and wire reference number; the bank's fraud desk will initiate the recall request to the receiving bank. Recall success rates are highest within 24 hours, drop sharply at 48 hours, and approach zero past 72 hours. In parallel, file an IC3 complaint at ic3.gov with the same details; the FBI's Recovery Asset Team coordinates with banks on transactions over $50,000 and has measurably higher recall rates than bank-only requests. Notify any counterparty whose payment was redirected; they may also need to file with their bank. If the redirected funds came from a customer, your contractual and reputational obligations kick in; involve legal counsel before any external communication. Document every call, time, and recipient in a contemporaneous timeline; you will need it for insurance claims and potential litigation.

Containment and eradication are tenant-wide, not just on the compromised user. For the affected mailbox: revoke all sessions with Revoke-AzureADUserAllRefreshToken (or the Graph equivalent), reset the password and require change at next sign-on, remove all OAuth grants for the user (Get-AzureADUserOAuth2PermissionGrant), delete attacker-created inbox rules, remove external forwarding, re-register MFA from scratch (delete and re-enroll, do not just add a factor). For the tenant: review and disable any new Exchange transport rules, mail flow connectors, or accepted domains created during the dwell period (these are favorite persistence mechanisms; attackers add a connector to silently exfiltrate mail). Audit all OAuth applications with high-privilege Graph permissions and revoke any granted in the last 90 days that you cannot positively identify. Enable Continuous Access Evaluation in Conditional Access if not already on; this shortens the window between session revocation and token invalidation from 1 hour to roughly 10 minutes. Force a password reset and MFA re-registration for any user who shared a session, device, or workflow with the compromised account. Finally, deploy or tune Conditional Access policies to block legacy auth, require phishing-resistant MFA for privileged roles, and block sign-in from high-risk countries if your workforce footprint allows.

BEC incidents frequently trigger notification obligations even when no funds were lost, because the attacker had access to mailboxes containing personal information. In the United States, all 50 states plus DC have breach notification laws; the trigger is generally unauthorized access to unencrypted personal information (name plus SSN, financial account, driver's license, medical info), and the notification window ranges from 30 to 90 days. For publicly traded companies, the SEC's 2023 cybersecurity disclosure rule requires an 8-K filing within four business days of determining a cybersecurity incident is material; BEC with confirmed wire fraud above the materiality threshold (often $1M or above, but check with counsel and investor relations) usually qualifies. For healthcare entities, HIPAA breach notification triggers if PHI was in the mailbox and the attacker accessed it; the 60 day notification clock to affected individuals plus HHS reporting applies. For EU data, GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a breach involving personal data. Build the notification timeline into the incident playbook so legal, compliance, and PR are engaged on day one, not day fifteen.