Business Email Compromise Incident Response: Stopping the Wire and Recovering the Account

BEC does not typically involve malware, malicious links, or suspicious attachments. Standard phishing detection controls (sandbox, URL rewriting, attachment detonation) do not catch BEC. Detection requires different signals.

BEC attack patterns:

Account takeover BEC: The threat actor compromises a legitimate internal account (most commonly via phishing, credential stuffing, or AiTM phishing) and uses it to send fraudulent payment instructions to finance or accounts payable. The email comes from a real internal account, bypasses all email filtering, and appears fully legitimate. Detection requires behavioral anomalies: the account sending emails from a new IP or location, unusual email volume, new mailbox rules forwarding copies to external addresses, or emails sent at unusual hours.

Vendor impersonation BEC: The threat actor sends email from a domain that convincingly resembles a legitimate vendor (invoice@vendorname-invoices.com instead of invoice@vendorname.com) or spoofs the vendor's From header. Detection: DMARC enforcement on the receiving domain, look-alike domain detection in your email gateway, and verification callbacks to known good phone numbers for any payment change request.

CEO fraud: Attacker impersonates the CEO or CFO via spoofed email to pressure an employee to initiate a wire transfer quickly. Always targets urgency and confidentiality ("do not discuss this with anyone"). Detection: DMARC enforcement, executive impersonation detection, and a verified callback policy for any wire transfer request regardless of sender.

Detection triggers for this playbook: finance team reports a suspicious payment change request, IT detects new inbox rules forwarding external email, Entra ID Identity Protection flags anomalous sign-in for a mailbox, email gateway flags a look-alike domain, or a vendor calls to ask about an unpaid invoice after a duplicate was paid to a different account.

The wire recall process must begin immediately upon discovering a fraudulent transfer. Every hour of delay reduces recovery probability.

Step 1 (within the first hour of discovery): Contact your bank's fraud department directly, not through standard customer service channels. Request an immediate recall or reversal of the fraudulent wire. Provide the transfer amount, date, originating account, and destination account. Many banks have a dedicated fraud response line; find it before an incident.

Step 2: File a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov immediately. Include the transaction details, originating and destination bank account numbers, and the fraudulent email chain. The FBI Financial Fraud Kill Chain program can freeze destination accounts if initiated within 72 hours of the transfer. After 72 hours, funds are typically moved to overseas accounts and are unrecoverable.

Step 3: If the destination bank is a US institution, your bank can contact them directly to freeze the fraudulent account. International wires are significantly harder to recall; success rates drop to below 10 percent once funds leave US correspondent banks.

Step 4: Notify your cyber insurance carrier immediately. Most commercial crime policies and cyber policies cover BEC losses, but timely notification is required for coverage. Check your policy for the notification window; some require notification within 24 to 72 hours of discovery.

Step 5: Preserve all financial records, email chains, and communications related to the fraudulent transfer for law enforcement and insurance documentation. Do not delete anything.

While the financial track is running, the security team must contain the compromised account and determine the full scope of attacker access.

Account containment (do immediately in parallel with financial track):

• Reset the compromised account password and invalidate all active sessions (in Microsoft 365: Entra ID admin center, revoke sessions under the user's sign-in activity).
• Revoke all OAuth tokens and app consents for the compromised account. Attackers frequently grant OAuth consent to malicious apps during account access to maintain persistence after password reset.
• Disable any new mailbox rules created in the compromised account. BEC actors commonly create rules to: forward all incoming email to an external attacker-controlled address, delete replies from the vendor or bank being impersonated (to prevent the victim from seeing legitimate replies), or move security alerts to obscure folders.
• Enable mailbox auditing on the compromised account if not already enabled (verify in the Microsoft Purview compliance portal).

Mailbox forensics (determine full scope of attacker access):

• Review the mailbox audit log for the compromised account covering the period before detection. Look for: emails read (did the attacker read sensitive threads?), emails sent on behalf of the account (all fraudulent communications sent from it), calendar access, and contact list access.
• Review the account's sign-in log in Entra ID. Identify: the first unusual sign-in (determines the compromise start date), sign-in locations and IP addresses (identifies attacker infrastructure), and authentication method used (legacy auth bypasses MFA).
• Review email forwarding rules and any new inbox rules created during the compromise window.
• Identify all external recipients who received email from the compromised account during the attacker's access window. These recipients may have received fraudulent payment instructions or malicious content.

After containment and forensics, close the entry points that allowed the compromise and add controls that detect future attempts.

For account takeover BEC (credential-based initial access):

• Enforce phishing-resistant MFA for all mailbox accounts. Standard TOTP MFA is vulnerable to real-time phishing and AiTM (adversary-in-the-middle) attacks using tools like Evilginx and Modlishka. Phishing-resistant MFA (FIDO2 hardware keys or Microsoft Authenticator with number matching and location verification) is not.
• Block legacy authentication protocols via Conditional Access. Legacy auth (Basic auth, IMAP, POP3) bypasses MFA and is the most common BEC initial access vector.
• Deploy Entra ID Identity Protection sign-in risk policies to automatically block or require step-up MFA for risky sign-ins (impossible travel, anonymous IP, leaked credentials).

For vendor impersonation and CEO fraud BEC:

• Enforce DMARC (p=reject or p=quarantine) on your sending domain. This prevents external actors from spoofing your domain to target your vendors and partners.
• Implement look-alike domain detection in your email gateway (Defender for Office 365 impersonation protection, or third-party tool). This catches domains like vendorname-invoices.com targeting your users.
• Implement a verified callback policy for all payment change requests: any request to change banking details for a vendor or to initiate a wire transfer must be verified via a callback to a pre-established phone number, regardless of how convincing the email is. This single procedural control defeats the majority of BEC attempts.