Business email compromise exposes the gap in identity and mail controls

At a glance

What this is: Prophet’s analysis shows that business email compromise succeeds when mail authentication, account telemetry, and business-process checks are treated as separate controls rather than one identity governance problem.

Why it matters: IAM, PAM, and identity operations teams need to treat mailbox compromise, session theft, and forwarding-rule abuse as governance failures that can move money and data, not just email security events.

Context

Business email compromise is a trust abuse problem: attackers impersonate a legitimate person or supplier, then use that perceived authority to change payment behaviour or obtain sensitive information. Email authentication can help identify spoofing, but it does not by itself stop a compromised mailbox, a stolen session, or a fraudulent request that looks procedurally normal.

The identity angle is real because BEC often depends on access to mailboxes, tokens, and downstream collaboration systems rather than malware alone. That puts the issue squarely across IAM, human identity verification, and non-human controls such as session revocation, forwarding restrictions, and audit coverage for mailbox automation.

Key questions

Q: What breaks when email authentication is in place but mailbox access is already compromised?

A: Email authentication can still pass even when the attacker is operating from a legitimate mailbox or stolen session. In that case, the message may look technically valid while the real failure is identity compromise, inbox-rule persistence, or fraudulent workflow use. Teams need to investigate the account, the session, and the business process together, not stop at the email header.

Q: Why do compromised mailboxes create so much downstream risk?

A: Compromised mailboxes are dangerous because they already sit inside trusted workflows. An attacker can read resets, approve requests, impersonate the user, or pivot into vendor and finance processes without needing to defeat every control layer. That is why mailbox compromise often becomes a gateway to broader credential abuse and business email compromise rather than a single-account event.

Q: What are the signs that BEC persistence is still active after password reset?

A: Look for external forwarding, new inbox rules, OAuth grants, app passwords, and active sessions that survive the reset. If those are still present, the attacker may continue to observe mail or manipulate messages without needing the original password. Persistence in BEC often sits in delegated access paths rather than the password itself.

Q: How should organisations verify high-risk requests that arrive by email?

A: Use an independent confirmation step outside the email thread for payments, vendor changes, payroll updates, and other high-impact actions. Verification should check the requester through a separate trusted channel and confirm the business event before any action is taken.

Technical breakdown

How email authentication helps and where it stops

SPF, DKIM, and DMARC are message-level controls that help receivers assess whether an email is authorised and intact. They are useful for reducing direct spoofing, but they do not prove that the sender is trustworthy, that the account has not been compromised, or that the request is legitimate. In BEC, the attacker may use a real mailbox, a lookalike domain, or a compromised identity with valid authentication results. That is why authentication verdicts must be correlated with identity-provider logs and workflow validation, not treated as a complete trust decision.

Practical implication: Treat SPF, DKIM, and DMARC as input to investigation, not as proof that a payment or access request is safe.

Why mailbox rules and tokens create persistence

Once an attacker gets into a mailbox, inbox rules, auto-forwarding, app passwords, and OAuth grants can preserve access even after the password changes. These are persistence mechanisms because they operate below the user’s immediate awareness and can continue redirecting, hiding, or exporting messages. Token-based access is especially dangerous because session revocation and password reset are not always equivalent. In practice, mailbox compromise becomes a control problem across identity, mail, and collaboration platforms, with the mailbox acting as a launch point for data theft and business manipulation.

Practical implication: Review forwarding rules, OAuth grants, and active sessions as part of containment whenever a mailbox shows suspicious behaviour.

How business-process abuse turns mail access into financial loss

BEC succeeds when attackers combine message deception with weak procedural verification. Even if the mailbox compromise is subtle, a rushed invoice change, a new bank account, or a vendor payment request can move the attack into real-world financial loss. This is why BEC sits at the intersection of identity assurance and business controls: the message may be technically plausible while still being procedurally fraudulent. The investigation therefore has to compare the request against documented approval paths, historical communication patterns, and verified vendor records.

Practical implication: Require secondary verification for payment changes and treat process deviation as a security signal, not just an operations issue.

Threat narrative

Attacker objective: The attacker’s objective is to exploit organisational trust to obtain money, confidential information, or both without triggering immediate suspicion.

1. Entry typically begins with impersonation through a spoofed domain, a lookalike sender, or a compromised mailbox that makes the message appear trusted.
2. Credential or session abuse follows when the attacker leverages stolen credentials, token grants, or mailbox access to read, redirect, or hide messages.
3. Persistence and impact emerge through inbox rules, forwarding, and business-process manipulation that let the attacker intercept invoices, suppress alerts, or trigger fraudulent transfers.

Breaches seen in the wild

• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

BEC is now an identity governance problem, not just an email security problem. SPF, DKIM, and DMARC can reduce spoofing, but they do not govern who can impersonate whom once a mailbox, token, or vendor relationship is already trusted. The control gap is the absence of a joined-up trust model across human identity, mail access, and business approval flows. Practitioners should treat mailbox trust as a lifecycle control, not a message filter.

Mailbox persistence is the real operational risk in BEC. Inbox rules, external forwarding, app passwords, and OAuth consent create hidden continuity after compromise. That makes the attack resilient to simple password resets and creates a standing-access problem inside collaboration platforms. The named concept here is mailbox persistence gap: a condition where account recovery actions do not fully remove the attacker’s ability to observe or manipulate communications.

Business process validation is the missing control layer. BEC does not need malware when it can exploit payment urgency, vendor change requests, or executive authority. Organisations that rely on technical authentication alone leave a governance blind spot between the inbox and the finance workflow. Practitioners should align identity assurance with transaction approval, because the loss occurs when trust crosses departments without re-verification.

Non-human access to mail systems deserves the same scrutiny as human users. OAuth grants, automated forwarding, and token-based sessions are machine-like access paths that can persist beyond the original user action. That means NHI-style governance concepts matter here as much as human IAM. If those delegated paths are not inventoried and governed, the organisation cannot prove where mail access is coming from or how long it lasts.

Fraud prevention teams and IAM teams need a shared operating model. BEC sits at the boundary between identity compromise and financial crime, so separating detection into silos weakens response. The most effective control stack combines identity telemetry, mail controls, and payment verification. Practitioners should expect the strongest improvements when the same incident path is visible to security operations and finance control owners.

From our research library:

• Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
• Read next: Email Identity and BEC Guide

What this signals

Mailbox persistence gap: organisations often over-focus on spoofing and under-focus on the delegated access paths that keep BEC alive after a reset. The practical shift is to treat forwarding rules, token grants, and approval exceptions as part of the same incident boundary, because that is where the attacker maintains control.

Identity teams should expect BEC detections to become more effective when message telemetry is joined to sign-in anomalies and finance exceptions. The programme question is not whether an email was suspicious, but whether the user, session, and workflow all agreed that the request was legitimate.

For practitioners

• Enforce mailbox-specific MFA and session revocation Require MFA on all mail and admin accounts, then revoke active sessions and refresh tokens during suspected compromise so password resets do not leave access behind.
• Disable uncontrolled external forwarding Block auto-forwarding to external domains unless explicitly approved, and alert on new rules that hide, delete, or redirect finance-related messages.
• Validate payment changes out of band Require a secondary verification step for bank detail changes, urgent transfers, and vendor re-routing requests, using a channel separate from email.
• Monitor inbox rules and OAuth grants Review mailbox rules, delegated application access, and unusual consent events together because they often reveal the persistence layer of a BEC incident.
• Correlate identity logs with business exceptions Join sign-in anomalies, impossible travel, legacy authentication, and unusual transaction requests so investigators can see whether a suspicious message matched a suspicious login.

Key takeaways

• Business email compromise succeeds when attackers can combine trust abuse, mailbox access, and procedural pressure into one fraud path.
• The article’s core evidence is that mail authentication alone does not neutralise compromised accounts, inbox-rule persistence, or payment manipulation.
• Organisations need identity-aware mail governance, out-of-band verification for money movement, and faster revocation of delegated access paths.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Mailbox Rule Persistence: Mailbox rule persistence occurs when an attacker creates forwarding, deletion, or filtering rules that keep control of a compromised inbox after the initial login. These rules can hide evidence, redirect messages, and preserve access even when the password is changed.
• DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
• Out-Of-Band Verification: A confirmation step that uses a different channel or method than the original request. It reduces the chance that a single spoofed email, voice call, or video session can authorize privileged activity or financial transfer.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in the context of practical identity operations. It helps practitioners connect mailbox, token, and delegated-access risks to broader identity governance programmes.