Anatomy of a business email compromise, from one inbox to a fraudulent payment

A business email compromise (BEC) rarely involves malware, and the final step is not technical at all: someone in finance pays an invoice to the wrong bank account. That is why it works. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints with reported losses of about $3.05 billion, up from $2.77 billion in 2024 and second only to investment fraud.

This article follows a typical BEC from start to finish. Each stage leaves traces, and each one is a chance for a defender to stop the attack before the money moves.

Two ways in: impersonation and takeover

BEC comes in two broad forms, and many attacks combine them:

• Impersonation: the attacker never touches your systems. They send mail from a lookalike domain (contoso-billing.com instead of contoso.com) or a free account with a convincing display name, pretending to be an executive, a supplier or a lawyer.
• Account takeover: the attacker signs in to a real mailbox, either in your organization or at one of your suppliers. Messages then come from the genuine address, often inside a genuine conversation, which makes them far harder to spot.

The rest of this article follows the second, more damaging form.

The attack, stage by stage

1. Getting into a mailbox

   Most takeovers start with stolen credentials. The usual routes are a phishing page that captures the password, an adversary-in-the-middle kit that also steals the session cookie and so gets past MFA, or a password spray against accounts with weak passwords. The first sign is often a sign-in from an unusual country, provider or device, which our tutorial on investigating a suspicious sign-in covers in detail.

2. Hiding from the real owner

   Before doing anything visible, the attacker makes sure the user will not notice them. The classic technique is email hiding rules: inbox rules that move messages containing words such as invoice, payment, bank or fraud to an obscure folder like RSS Feeds or Archive, mark them as read, or delete them. Another rule may forward copies of everything to an outside address, a technique MITRE ATT&CK tracks as Email Forwarding Rule (T1114.003).

3. Reading and waiting

   Now the attacker studies the mailbox. They learn who pays whom, when invoices are due, how the user writes and which conversations involve money. This phase can last days or weeks, and it is what makes the eventual request so convincing.

4. Making the request

   At the right moment, the attacker steps into a real conversation. A typical message replies to a supplier thread: the bank account has "changed", the new details are attached, and the payment is urgent. If the attacker controls the supplier's mailbox, the email comes from the right address. If they only control yours, they may move the conversation to a lookalike domain, copying the thread so it looks continuous. Social engineering does the rest: urgency, authority and a request to keep it quiet.

5. Moving the money

   The payment goes to an account controlled by the criminals, usually a money mule, and is moved on quickly, often abroad or into cryptocurrency. Every hour reduces the chance of recovering it.

6. Spreading

   A compromised mailbox is also a trusted launch pad. Attackers often send phishing from it to customers and partners, who have every reason to trust the sender. One BEC can become the starting point for several more.

A typical timeline

A fictional but realistic case shows how the stages fit together:

• Day 1: a payables clerk enters their password on a fake document-sharing page. The kit also steals the session cookie.
• Day 1, an hour later: a new inbox rule moves any message containing "invoice" or "bank" from one supplier to the RSS Feeds folder and marks it as read.
• Days 2 to 12: the attacker reads the clerk's mail from a hosting provider's IP address.
• Day 13: the attacker emails the supplier from a lookalike domain, asking for the latest invoice "for our records", and then sends the clerk updated bank details in reply to the supplier's real thread.
• Day 14: the payment is made. The supplier asks about the missing payment three weeks later.

Every one of these steps happened in a log that someone could have looked at.

Where defenders can catch it

• Sign-ins: unfamiliar locations, providers and devices, especially right before mailbox changes. An AiTM sign-in often shows a session used from a different IP address than the one that completed MFA.
• Inbox rules and forwarding: new rules that move, delete or mark mail as read, rules filtering on payment words, and forwarding to external addresses. Microsoft Defender raises alerts for suspicious inbox manipulation, and its alert grading playbook explains how to judge them.
• Sent mail: messages sent from the account at odd hours or from new IP addresses, or bursts of mail to external contacts.
• Lookalike domains: inbound mail from newly registered domains that differ from a known supplier by a letter or a hyphen.
• The payment process itself: a request to change bank details is the moment the attack becomes visible to people outside security.

If your tenant sends Microsoft 365 activity to Defender for Cloud Apps, this advanced hunting query lists recent inbox rule changes across the organization, with the rule settings, based on the one in Microsoft's playbook:

CloudAppEvents
| where Timestamp > ago(30d)
| where Application == "Microsoft Exchange Online"
| where ActionType in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| project Timestamp, AccountDisplayName, ActionType, IPAddress, CountryCode,
    RuleConfig = RawEventData.Parameters
| order by Timestamp desc

Most rules are harmless: people file newsletters and receipts all the time. Look for rules that delete or hide mail, filter on words about money or security, forward outside the organization, or were created from an IP address the user has never used.

If it already happened

Speed matters more than anything else:

• Call the bank immediately and ask for a recall of the transfer. In the United States, also file a complaint at ic3.gov; the IC3 notes that its asset recovery work depends on complaints being filed as quickly as possible. Elsewhere, contact your bank and the police.
• Take the attacker out of the mailbox: revoke the user's sessions, reset the password, check the MFA methods registered on the account, and remove malicious rules and forwarding.
• Look for other footholds: check the apps the user consented to, as described in our tutorial on malicious OAuth app consent, and search for other accounts signed in from the same IP addresses.
• Warn the people involved: the supplier or customer whose thread was hijacked, and anyone who received mail from the compromised account.

Treat it as a full incident, with a written timeline, not as a password reset.

How to make it harder

• Verify payment changes out of band. Any change to bank details is confirmed by phone, using a number you already had, never one from the email. This single rule stops most BEC losses.
• Use stronger MFA. Phishing-resistant MFA, such as passkeys, defeats the AiTM kits behind many takeovers, and Conditional Access can limit where accounts can sign in from.
• Block automatic external forwarding. In Exchange Online, the outbound spam policy controls it. Microsoft recommends setting it explicitly to Off rather than leaving the Automatic default, whose behavior differs between organizations (Control external email forwarding).
• Mark external mail. A visible "external sender" tag makes a lookalike domain inside a familiar thread easier to notice.

Why it matters for a SOC analyst

BEC is a fraud that runs on identity and email logs, so a SOC that understands both can stop it before the payment. The signals are individually small: one odd sign-in, one new inbox rule, one reply from a slightly different domain. Learn to connect them, make "check the inbox rules" a reflex in every account compromise, and remember that the most effective control is often a phone call made by someone in finance.