Topic starter
02/08/2026 11:26 am
TL;DR: Business email compromise can still move through trusted workflows even when email authentication passes, Prophet finds, because mailbox access, inbox-rule persistence and payment manipulation can line up in one fraud path. Mail governance has to track accounts, sessions and approval steps together, or compromise can keep steering business processes.
Editorial analysis by NHI Mgmt Group, based on content published by Prophet: “Investigating Business Email Compromise (BEC): A Practical Approach”.
Key questions
Q: Why do compromised mailboxes create so much downstream risk?
A: Compromised mailboxes are dangerous because they already sit inside trusted workflows.
Q: What are the signs that BEC persistence is still active after password reset?
A: Look for external forwarding, new inbox rules, OAuth grants, app passwords, and active sessions that survive the reset.
Q: What breaks when email authentication is in place but mailbox access is already compromised?
A: Email authentication can still pass even when the attacker is operating from a legitimate mailbox or stolen session.
Practitioner guidance
- Enforce mailbox-specific MFA and session revocation Require MFA on all mail and admin accounts, then revoke active sessions and refresh tokens during suspected compromise so password resets do not leave access behind.
- Disable uncontrolled external forwarding Block auto-forwarding to external domains unless explicitly approved, and alert on new rules that hide, delete, or redirect finance-related messages.
- Validate payment changes out of band Require a secondary verification step for bank detail changes, urgent transfers, and vendor re-routing requests, using a channel separate from email.
Bottom line: Business email compromise succeeds when attackers can combine trust abuse, mailbox access, and procedural pressure into one fraud path.
Glossary terms: Business email compromise, Mailbox Rule Persistence, DMARC, Out-Of-Band Verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
02/08/2026 12:42 pm
BEC is now an identity governance problem, not just an email security problem. SPF, DKIM, and DMARC can reduce spoofing, but they do not govern who can impersonate whom once a mailbox, token, or vendor relationship is already trusted. The control gap is the absence of a joined-up trust model across human identity, mail access, and business approval flows. Practitioners should treat mailbox trust as a lifecycle control, not a message filter.
A few things that frame the scale:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
A question worth separating out:
Q: How should organisations verify high-risk requests that arrive by email?
A: Use an independent confirmation step outside the email thread for payments, vendor changes, payroll updates, and other high-impact actions. Verification should check the requester through a separate trusted channel and confirm the business event before any action is taken.
👉 Read our full editorial: Identity-aware mail governance is the real BEC control gap
This post was modified 5 days ago by NHI Mgmt Group