Email takeover vs spoofing: which controls actually stop BEC?

TL;DR: Email account takeover gives an attacker authenticated control of a real mailbox, while spoofing only forges sender information, and the difference changes what defenders can verify, contain, and report during business email compromise, according to Adaptive Security. SPF, DKIM, and DMARC do not prove who used the mailbox, so access telemetry and out-of-band verification remain decisive.

Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Email Account Takeover vs Email Spoofing: Key Signs, Controls, and Response for Business Email Compromise”.

Key questions

Q: What breaks when organisations rely only on email authenticity checks to stop business email compromise?

A: Email authenticity checks help, but they do not stop account theft, internal spoofing, or a compromised mailbox sending legitimate looking messages.

Q: Why does a compromised mailbox remain dangerous even when email authentication passes?

A: Because authentication proves message path and domain alignment, not user intent.

Q: What are the signs that an email account takeover is underway?

A: Common warning signs include unusual login patterns, unfamiliar devices or browsers, shifts in writing style or tone, and attempts to bypass multi factor authentication.

Practitioner guidance

• Inspect mailbox access before message content When a suspicious email appears to come from a real colleague, check sign-ins, sessions, OAuth grants, and mailbox rules before treating it as simple spoofing.
• Revoke persistence paths during containment Remove forwarding rules, delegated access, active tokens, and suspicious app permissions as part of the first containment step.
• Separate header review from account review Use header analysis, domain alignment, and sending infrastructure checks to confirm spoofing, then use audit logs and user activity to determine whether the mailbox was actually compromised.

Bottom line: Email account takeover and spoofing are different abuse paths, but both can produce business email compromise if teams trust the message instead of the identity.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →