Common indicators include unusual login locations, impossible travel, new inbox rules, unexplained forwarding behaviour and active sessions that do not match the user’s normal pattern. Those signals matter because BEC is often a trust-abuse event rather than a malware event, so mailbox behaviour is the earliest clue.
What changes when mailbox behaviour stops looking normal?
Once an email account moves from ordinary use into compromise, the pattern usually changes before the content does. The earliest shift is behavioural: login geography no longer fits the user, session activity appears at odd hours, and mailbox actions begin to support attacker goals such as persistence, monitoring, or fraud. That is why mailbox telemetry is often more reliable than a single alert.
A compromised account may still look “alive” to the end user because the attacker often wants quiet access, not immediate disruption. That means the key signs are rarely dramatic system failures. They are small but coherent deviations, especially when several appear together, such as unfamiliar authentication, message-rule changes, and forwarding that the user never set up.
One useful way to think about the transition is that normal use is human-patterned while compromise is goal-patterned. In benign use, behaviour reflects routine work, travel, device rotation, and occasional mistakes. In compromise, behaviour tends to cluster around access retention, message interception, and downstream abuse, which can include invoice fraud, password resets, or lateral access into other services.
Which mailbox changes are the strongest compromise indicators?
The most telling indicators are the ones that are difficult to explain as routine variance. Unusual login locations, impossible travel, and sessions from devices or networks the user does not normally use are high-value signals because they suggest the account is being accessed outside the user’s normal pattern. New inbox rules that hide, delete, or redirect mail are especially suspicious because they often create persistence and stealth at the same time.
Forwarding changes deserve particular attention when they send mail to an external address or to an internal mailbox with no business reason. Attackers frequently use forwarding to collect one-time codes, payment-related messages, and reset links without alerting the victim. If the user also reports missing messages, unread items disappearing, or rule changes they did not author, treat the account as materially suspect rather than merely noisy.
Mailbox compromise can also present as subtle activity around sent items, deleted items, and delegates. Messages may be marked read without being opened by the user, conversations may be archived early, or new access paths may appear through OAuth consent, app passwords, or mailbox delegation. Those patterns matter because a mailbox takeover is often less about overt spam and more about maintaining quiet control of the communication channel.
How do you separate noisy anomalies from a real compromise?
The decision point is correlation, not any single event. One strange login can be a VPN, travel, or a mobile handoff. A strange login plus a new forwarding rule plus a message purge pattern is a very different story. If the behaviour fits the user’s normal workflow, the signal is weaker; if it fits an attacker’s need for concealment or payment diversion, the signal becomes materially stronger.
This is where a broader identity view helps. Account compromise is often the end result of credential theft, session theft, consent abuse, or weak recovery controls, and Account Takeover Prevention Guide is useful because it frames the same login anomalies in the context of attack paths and session risk. For email-specific abuse patterns, Email Identity and BEC Guide connects mailbox takeover with inbox rules, forwarding abuse, and payment fraud.
When the account is used in business processes, the behavioural clue can be the first sign of a larger trust problem rather than a standalone login issue. That is why mailbox monitoring should be interpreted alongside payment workflows, reset flows, and any mailbox permissions that can silently extend access. If the account participates in finance, HR, or executive communication, the threshold for escalation should be lower.
Risk and Threat Considerations
email compromise is dangerous because the mailbox is both a communications channel and a trust anchor. An attacker who controls it can read, redirect, delay, or reshape business conversations without triggering obvious malware symptoms, and that makes compromise easy to miss until fraud or account recovery abuse begins.
Failure mechanism: The attacker gains access through stolen credentials, stolen sessions, malicious consent, or rule-based persistence, then uses mailbox features such as forwarding, inbox rules, and replies to maintain access and abuse trust relationships.
Impact: Sensitive messages, reset links, invoices, and approvals can be intercepted or manipulated, which can lead to payment diversion, wider account takeover, and lateral abuse of connected services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114 — Email Collection | Mailbox abuse and mail interception are core to this compromise pattern. |
| Recommendation — Map mailbox interception and rule abuse to email collection activity and hunt for persistence paths. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Mailbox compromise detection depends on reviewing anomalous login and rule activity. |
| IA-5 — Authenticator Management | Compromise commonly follows stolen credentials or sessions used to access email. | |
| Recommendation — Review mailbox and authentication logs for unusual sign-ins, forwarding changes, and session anomalies. Rotate or revoke exposed authenticators, tokens, and sessions when mailbox compromise is suspected. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Mailbox takeover often involves token or consent abuse in modern email platforms. |
| Recommendation — Validate OAuth consent and token handling to reduce silent mailbox access abuse. | ||
| CIS Controls v8 | CIS-5 — Account Management | Compromised email accounts are an account management and anomaly detection issue. |
| Recommendation — Monitor account changes, session anomalies, and access rule modifications for takeover indicators. | ||
Practitioner Guidance
What to prioritise: Treat a cluster of mailbox anomalies as a containment problem before you treat it as a ticket. If unusual logins, impossible travel, and new forwarding or inbox rules appear together, assume the mailbox may already be operationally useful to an attacker.
What to verify: Confirm the user’s normal device set, travel pattern, and message-handling habits before dismissing the alert. Then check for rule creation, forwarding destinations, delegated access, and active sessions that do not match the user’s expected behaviour.
Decision rule: If the mailbox can receive sensitive business mail or reset links, escalate immediately and review adjacent accounts that may inherit trust from that mailbox. If it is a low-value mailbox with a single benign anomaly, investigate first, but do not ignore repeated changes to mail handling.
Practitioner takeaway: The most important judgement is whether the mailbox is still merely noisy or already being used to preserve attacker access. Once mailbox behaviour starts supporting stealth or redirection, assume compromise until proven otherwise.
Related resources from NHI Mgmt Group
- What are the signs that a phishing attack is moving beyond email into account takeover or post-compromise activity?
- What are the signs that supplier account compromise is being used to drive business email compromise?
- What happens when attackers use inbox rules after they compromise an email account?
- What are the signs that an email account has been turned into a phishing launchpad after compromise?