What should organisations do after a BEC email account is compromised?

What to secure first after a BEC compromise

The first priority is containment, not cleanup. Lock the mailbox, revoke active sessions, reset credentials, and remove any attacker persistence such as forwarding rules or delegated access. At the same time, preserve logs and message data so you can reconstruct what the attacker saw and changed before you alter too much evidence.

Because BEC often uses a real account rather than malware, the response should treat the mailbox as a live intrusion point. That means checking whether the compromise was limited to one user or whether it extends through shared mailboxes, helpdesk resets, SSO-linked access, or related vendor portals that may trust the same identity.

How to scope the fraud and message abuse

After containment, determine what the attacker actually did with the account. Review sent items, deleted mail, inbox rules, auto-forwarding, OAuth consents, and any thread hijacking that could have been used to alter payment instructions or impersonate the victim in ongoing conversations. Preserve timestamps and headers so finance, legal, and investigators can trace the full path of abuse.

It is also important to reconstruct business impact quickly. Verify whether any invoices, bank details, or beneficiary instructions were changed, and confirm with counterparties through trusted channels before assuming a payment request is genuine. If the mailbox was used to target customers, suppliers, or internal approvers, those communication threads should be treated as potentially tainted until reviewed.

How to stop repeat abuse and recover safely

Recovery should focus on both the account and the surrounding process. A compromised mailbox can be re-used for renewed phishing, payroll diversion, or vendor fraud if hidden rules, stolen tokens, or connected apps remain in place. That is why mailbox recovery and business-process recovery have to happen together, not as separate tickets.

Use the incident to harden the specific path that failed. The organisation should require out-of-band verification for payment changes, review mailbox delegation and transport rules, and check whether recovery channels, MFA settings, or reset workflows let the attacker regain access after the initial lockout. If the same pattern could recur across other users, the response must include broader control changes, not just one-off cleanup.

Risk and Threat Considerations

BEC is dangerous because the attacker is operating inside a trusted communication stream. Once a mailbox is compromised, the adversary can observe payment workflows, impersonate executives or suppliers, and quietly alter instructions without triggering the kinds of alerts that usually catch external phishing.

Failure mechanism: The compromise succeeds when the attacker can remain authenticated long enough to read correspondence, create persistence in mail settings, and exploit business trust before the fraud is detected.

Impact: The result can include redirected payments, exposure of sensitive contracts or payroll data, and additional compromise of downstream accounts that rely on the same mailbox or approval workflow.

Practitioner Guidance

What to verify: Confirm session revocation, password reset, MFA state, mailbox rules, forwarding addresses, and any OAuth grants or delegated permissions that could restore access after the initial cleanup. If those artefacts remain, the account is not truly recovered.

Decision rule: If the account touched finance, procurement, or vendor payment flows, treat the incident as both an identity event and a fraud event. That means parallel handling by security and finance, with banking partners contacted early rather than after internal triage finishes.

Practitioner takeaway: The key judgement is to assume the mailbox was a trusted fraud platform, not just a stolen login, and to validate every related communication and payment path before declaring recovery complete.

Related resources from NHI Mgmt Group

• Guide: Email Identity and BEC Guide
• Why do legacy secure email gateways miss lateral movement after an email account is compromised?
• What happens after a compromised email account is used to distribute malware to other diplomatic offices?
• What should people do after they suspect their email or social media account has been compromised?
• How can teams reduce lateral phishing after one account is compromised?