Notifications
Clear all
Topic starter
02/08/2026 11:26 am
TL;DR: Business email compromise remains one of the most financially damaging cybercrime patterns, with global losses surpassing $50 billion since 2013 and nearly $3 billion reported in the United States in 2023, according to the FBI. The operational lesson is that email authentication alone does not stop account takeover, inbox-rule persistence, or business-process manipulation.
NHIMG editorial — based on content published by Prophet: Investigating Business Email Compromise, a practical approach
By the numbers:
- Business email compromise has driven more than $50 billion in global losses since 2013.
- $3 billion in losses were reported in the, in the United States in 2023.
Questions worth separating out
Q: What breaks when a compromised mailbox is treated like a normal email problem?
A: The organisation misses persistence, privilege, and fraud pathways that live beyond the message itself.
Q: Why do business email compromise attacks often bypass technical email filters?
A: Because the attacker may use a real account, a valid token, or a lookalike business process rather than a simple spoof.
Q: How do security teams know if inbox-rule monitoring is actually working?
A: They should be able to detect new forwarding, deletion, or filtering rules soon after they are created and tie them to the originating sign-in event.
Practitioner guidance
- Preserve the original message before analysis Pull the email from the user mailbox or message trace and keep it as an .eml or .msg file so header chains, authentication results, MIME structure, and x-headers remain intact.
- Revoke mailbox sessions and tokens together If compromise is suspected, reset the password and immediately revoke active sessions, refresh tokens, and app passwords so the attacker cannot keep acting through an existing authenticated context.
- Review inbox rules for persistence and exfiltration Look for forwarding to external addresses, auto-deletion of messages with payment keywords, and suppression rules that hide replies or alerts from finance and HR.
What's in the full article
Prophet's full blog post covers the operational detail this post intentionally leaves for the source:
- Raw header and authentication walkthroughs for SPF, DKIM, and DMARC analysis
- Example mailbox-rule artefacts and the log sources used to confirm persistence
- Step-by-step containment actions for token revocation, rule removal, and stakeholder notification
- Investigation checkpoints for finance and HR workflow validation
👉 Read Prophet's practical guide to investigating business email compromise →
Business email compromise: what identity and mail controls miss?
Explore further
02/08/2026 12:42 pm
BEC is an identity abuse problem disguised as email fraud. The article shows that the deciding factor is often not whether a message looks suspicious, but whether a trusted account, token, or mailbox rule has been abused. That places BEC squarely in IAM and NHI governance, because the attacker is effectively operating through a compromised digital identity with persistent access. Practitioner takeaway: treat mailbox access as an identity control domain, not just a messaging issue.
A question worth separating out:
Q: Who is accountable when a payment is redirected through a fraudulent email request?
A: Accountability is shared across email security, IAM, finance operations, and the business owner of the approval process. Technical controls such as DMARC and MFA reduce exposure, but they do not replace verification procedures for beneficiary changes or urgent transfers. Organisations need a clear owner for the control that confirms the request is real before funds move.
👉 Read our full editorial: Business email compromise exposes the gap in identity and mail controls
