Business Email Compromise (BEC) Response & Investigation

Business email compromise (BEC) happens when an attacker takes over or impersonates a trusted email account to redirect payments, steal data or trick staff into acting on fake instructions. If you think it has happened to you, speed matters: the sooner your bank and law enforcement are involved, the better the chance of stopping a transfer. Our team investigates the compromise, contains it, supports fund recovery and closes the gaps that let it happen. It is part of our incident response services.

Under attack right now? Call 1-800-390-1053 for immediate help.

How we help

First steps if you suspect BEC

Do these right away, and call us:

Call your bank immediately to request a recall or hold on any fraudulent transfer
Report the fraud to the FBI at ic3.gov as soon as possible
Do not delete the suspicious emails or mailbox rules; they are evidence
Reset the affected account’s password from a clean device and sign out all sessions
Warn finance staff and key partners not to act on payment changes by email

Investigation of the compromised mailbox

We analyze Microsoft 365 or Google Workspace logs to establish how the attacker got in and what they did:

Sign-in history, locations, devices and MFA changes
Malicious inbox rules, forwarding and hidden folders
Third-party apps or OAuth consents the attacker added
Which emails and attachments were read, sent or exported, which drives any notification decision
Whether other accounts, partners or customers were targeted

Containment and fund recovery support

We remove the attacker’s access, revoke tokens and malicious app consents, and prepare the timeline and evidence your bank, law enforcement, cyber insurer and legal counsel need to pursue recovery and decide on notification.

Hardening so it does not happen again

Phishing-resistant MFA, conditional access and blocking legacy authentication
Alerts for suspicious sign-ins, inbox rules and forwarding
SPF, DKIM and DMARC so attackers cannot spoof your domain
Payment verification procedures: confirm every new or changed payment instruction by phone using a known number
Staff training, phishing simulations and a tabletop exercise that rehearses a fraudulent payment request

How Our Business Email Compromise (BEC) Response Works

Triage

We take your call, confirm what happened and which accounts and payments are involved, and make sure the bank and law enforcement have been contacted.

Contain

We lock out the attacker: reset credentials, revoke sessions and tokens, remove malicious rules and app consents, and check other accounts for compromise.

Investigate

We reconstruct the attacker's activity from audit and sign-in logs, determine what data was accessed and identify everyone who was targeted.

Report

You receive a clear timeline and findings for leadership, your insurer, counsel and law enforcement, including what data was exposed for notification decisions.

Harden

We close the gaps that allowed the compromise, often starting with a Microsoft 365 security assessment, and help put payment verification controls in place.

Think You Have Been Hit by BEC?

Call 1-800-390-1053 now or schedule an urgent call. The sooner we start, the more we can do.

Get Help or Request a Quote

Need help now? Call 1-800-390-1053. For anything else, tell us what you need and a senior consultant will reply within one business day.

Name

Work email

Company

Phone

What do you need?

Tell us a little about it

Frequently Asked Questions

What is business email compromise?

Business email compromise is a scam in which an attacker takes over or convincingly impersonates a trusted email account, such as an executive, vendor, attorney or title company, and uses it to redirect payments, change banking details or obtain sensitive information.

What should we do first if we sent money to a fraudster?

Call your bank immediately and ask for a recall of the transfer, then report it to the FBI at ic3.gov. Speed is critical because funds are moved quickly. Then contact us to investigate and contain the compromise.

Can the money be recovered?

Sometimes. Recovery is most likely when the bank and law enforcement are contacted within hours of the transfer. We help by producing the evidence and timeline banks, law enforcement and insurers need, but recovery depends on how quickly the transfer is reported and where the funds went.

Do we have to notify anyone after a BEC incident?

It depends on what the attacker could access. If the mailbox contained personal, health or financial information, state breach laws or regulations such as HIPAA, GLBA or SEC Regulation S-P may require notification. Our investigation determines what was accessed so you and your counsel can decide.

Does cyber insurance cover BEC?

Many policies cover incident response and some cover funds transfer or social engineering fraud, often with specific conditions and limits. Notify your insurer promptly; we work with insurers and their panel counsel and can coordinate with them from the start.

How do we prevent business email compromise?

Phishing-resistant MFA, blocking legacy authentication, alerts for suspicious sign-ins and inbox rules, DMARC, and above all a rule that every new or changed payment instruction is verified by phone using a known number, never by replying to the email.