Business Email Compromise (BEC) Response and Prevention
Someone signed in to a mailbox, read quietly for weeks, then sent one convincing email: new bank details, an urgent wire, a payroll change. We lock the attacker out of Microsoft 365, establish exactly what they touched, and close the gaps so it does not happen twice.
Talk to us about a BEC incidentOr call us directly: +1 (332) 241-6493
Why HIFENCE?
BEC investigations are led by specialists who are also certified in offensive security - people who know how these attackers move inside Microsoft 365 because they test the same techniques.
Signs of business email compromise
A BEC attack is quiet by design. The attacker wants weeks of access, not a noisy breach. These are the signals we see most often - if you recognize one, treat it as an incident until proven otherwise:
- A colleague gets replies to emails they never sent
- Inbox rules nobody created - moving or deleting messages that mention invoice, payment, wire or bank
- Sign-ins from unfamiliar countries or hosting providers, or "impossible travel" alerts
- A new MFA method or app consent on the account that nobody remembers adding
- A vendor asking about a bank-detail change you never requested
- Sent Items or Deleted Items suddenly emptied
BEC comes in two forms: account compromise, where the attacker controls a real mailbox in your tenant or a vendor's, and email impersonation, where they spoof your domain or register a look-alike one. Both end the same way - a payment goes to the wrong account, or data leaves the company.
How we respond to a business email compromise
1. Contain: lock the attacker out
Changing the password is not enough - sessions and tokens survive it. We reset credentials, revoke every active session, remove attacker-registered MFA methods and malicious OAuth app consents, and delete the inbox rules, forwarding and delegated access that keep the attacker in the loop.
2. Investigate: what did they see and send?
Using Entra ID sign-in logs, the Microsoft Purview audit log and message traces, we establish when access began, which mailboxes are affected (the first one is rarely the only one), what was read, and which fraudulent emails went out - to whom. You get a written timeline you can hand to your insurer, counsel or law enforcement.
3. Close the gaps for good
Phishing-resistant MFA and Conditional Access, legacy authentication blocked, user app consent restricted, external forwarding blocked, DMARC moved to enforcement, impersonation protection tuned - plus a payment verification procedure your finance team can actually follow.
If money may already have been sent, call your bank first and ask for a recall - minutes matter more than anything else on this page.
BEC incident response: what you get
- Containment, done properly - sessions revoked, persistence removed (MFA methods, OAuth apps, inbox rules, forwarding, delegation), and every affected account identified, not just the first one reported.
- Incident timeline - initial access, what the attacker read, what they sent and to whom, in plain language plus a technical annex. The document insurers, lawyers and the FBI IC3 report ask for.
- Help limiting the damage - what to tell your bank right away to attempt a recall, and clear wording for the customers and vendors who received fraudulent emails from your domain.
- Microsoft 365 hardening plan - the exact settings that would have stopped this attack, in priority order. For a full tenant review, see our Microsoft 365 security assessment.
- Payment-fraud controls - callback rules for changed bank details and approval steps for unusual transfers, so the next convincing email dies before the money moves.
A real BEC attack, stopped in 4 hours
When The Lovely Works, a video production company, called HIFENCE, attackers already had active access to their email systems and a EUR 300,000 fraud was in progress. We cut off the access within 4 hours, operations resumed in 2 days - and afterward we put in place MFA everywhere, payment verification procedures and anti-phishing training.
“We had a serious case of business email compromise - someone hacked our email. When something like that happens, it is serious; a company can shut down over it. Daniel from HIFENCE solved the problem in the first hours, better than either of the two providers we had worked with before: he went straight to the core of the problem and left us with clear standards for security and for how we work over email from now on.”
BEC prevention that actually works
Technology stops most account takeovers; process stops most payments. You need both:
phishing-resistant MFA for admins and finance, Conditional Access that blocks risky sign-ins
and legacy protocols, DMARC at p=reject so nobody can send as your exact domain,
external-sender tagging and impersonation protection for executives and key vendors - and a
rule that no bank detail changes without a call to a number you already have. For the people
side, see phishing protection and
security awareness training.
What this service is not
So you know exactly what you are getting when you call us in the middle of an incident:
It is not a 24/7 hotline.
We are a senior consultancy. Contact us and we will tell you honestly whether we can help within your timeframe - we do not promise response times we cannot keep.
It is not "just reset the password".
Most failed BEC clean-ups stop at a password change. Attackers keep access through sessions, their own MFA method, an OAuth app or a forwarding rule - we remove all of them and prove it in the logs.
It is not a product sale.
We do not resell email security licenses. We harden the Microsoft 365 you already pay for and tell you when a licence upgrade would close a real gap - and when it would not.
BEC is one scenario of incident response. To find the weak spots before an attacker does, start with a Microsoft 365 security assessment or our email security service.
Frequently asked questions
What is business email compromise (BEC)?
Our email was hacked. What should we do right now?
The fraudulent emails came from our real address and passed DMARC. How?
Can we get the money back after a BEC wire transfer?
How do attackers get past MFA?
How much does BEC response cost?
Prefer to send a written question?
Send a few details and we reply within 24h.