Business Email Compromise in Microsoft 365: Detect, Respond, Prevent
Attackers take over a real mailbox, hide their tracks with inbox rules, and redirect payments. Learn how it happens and which Microsoft 365 controls close the gaps.
Hidden Forwarding Rules and Unusual Sign-ins Come First
Unexpected forwarding or delete rules, impossible-travel sign-ins, new OAuth apps and bank-detail change requests are the signals that a mailbox is already in someone else's hands.
Find the Gaps Before an Attacker Finds Your Mailbox
The $3,500 fixed-price Microsoft 365 Security Audit runs 200 read-only checks across identity, mailbox auditing, OAuth consent and mail flow, with a remediation roadmap.
When the Attacker Is Inside a Real Mailbox
Business email compromise in Microsoft 365 happens when an attacker gains access to a mailbox, impersonates an executive or vendor, manipulates invoices, creates hidden forwarding rules, abuses OAuth apps, or uses stolen sessions to bypass ordinary password controls. Because the messages come from a legitimate account, spam filters and staff often trust them.
Small and midsize businesses are affected as much as large ones, especially where email, cloud systems, remote access and privileged accounts are not reviewed regularly. No single email control can guarantee fraud prevention, so identity, monitoring and payment verification have to work together.
How Business Email Compromise Unfolds in Microsoft 365
Each stage of a BEC incident leaves evidence in Microsoft 365 if logging and alerting are configured.
How Attackers Get In
Most Microsoft 365 BEC starts with identity, not malware. The attacker needs a working session or a consented app.
- Credential phishing against Microsoft 365 users
- Token theft and session hijacking
- MFA fatigue push-approval abuse
- Malicious OAuth apps with mailbox access
- Compromised vendor or executive accounts
- Legacy authentication left enabled
Warning Signs to Watch
These indicators usually appear days or weeks before money moves.
- New forwarding, delete or hide rules
- Impossible travel or unfamiliar devices
- Bank-detail changes requested by email
- OAuth apps with broad mailbox permissions
- Partners report odd messages from you
- Unexpected delegate or mailbox permissions
First Response Steps
Speed matters: contain the account, preserve evidence, then check what the attacker touched.
- Reset password and revoke all sessions
- Remove malicious inbox and transport rules
- Revoke suspicious OAuth app consents
- Preserve Unified Audit Log evidence
- Alert finance to hold pending payments
- Notify affected vendors and customers
Prevention Controls
Layered identity and monitoring controls reduce both the chance and the impact of a compromise.
- Phishing-resistant MFA for admins and finance
- Conditional Access with device and location risk
- Least privilege and regular role reviews
- Block user consent to unverified apps
- Mailbox auditing and centralized logging
- Documented incident response roles
Payment Verification Process
Technology cannot catch every fraudulent request. A verification process stops the money even when the email looks real.
- Verify bank changes by known phone number
- Never use contact details from the email
- Dual approval for new payees
- Controlled vendor master-data changes
- Extra scrutiny on urgent executive requests
- Train finance staff on BEC patterns
Microsoft 365 Controls That Limit BEC Damage
Microsoft 365 Security Audit: 200 read-only checks, four clear reports.
Executive report, technical report with remediation steps, risk register and remediation roadmap. Read-only access; nothing changes in your tenant.
Led by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT and cybersecurity. Based in Irvine, on-site across Southern California, remote nationwide.
About Ali →Need hands-on fixes or ongoing management?
OC Security Audit stays independent and read-only. If you want hands-on administration, IT Perfection can implement the fixes and support ongoing operations.
How a Read-Only BEC Risk Review Works
- STEP 1Scoping CallDiscuss your tenant, payment workflows and any recent suspicious activity with Ali Hassani.
- STEP 2Read-Only AccessGrant read-only permissions; no changes are made to your Microsoft 365 tenant.
- STEP 3200 ChecksIdentity, mailbox auditing, OAuth consent, forwarding rules and mail flow are reviewed.
- STEP 4Four DeliverablesExecutive report, technical report, risk register and remediation roadmap.
- STEP 5WalkthroughReview findings together and prioritize the fixes that most reduce BEC exposure.
Keep going.
Microsoft 365 Email Security Services
Ongoing Defender, anti-phishing and email authentication hardening for your tenant.
Read more →Microsoft 365 Security Audit
$3,500 fixed-price, read-only, 200 checks, four deliverables, any tenant size.
Read more →Incident Response and Digital Forensics
Help containing an active compromise and preserving evidence.
Read more →BEC Payment Verification
Practical payment verification steps that stop fraudulent wire and ACH changes.
Read more →Frequently asked questions
What is business email compromise in Microsoft 365?
It is when an attacker gains access to a Microsoft 365 mailbox or impersonates one, then uses it to manipulate invoices, redirect payments or steal data. Common techniques include hidden forwarding rules, malicious OAuth apps and stolen sessions that bypass ordinary password controls.
How does a Microsoft 365 mailbox usually get compromised?
Common paths are credential phishing, token theft, session hijacking, MFA fatigue and malicious OAuth apps. Weak monitoring then delays detection, giving the attacker time to study payment conversations.
What should we do first if we suspect a compromised mailbox?
Reset the password, revoke sessions, remove suspicious inbox rules and OAuth consents, and preserve audit log evidence before it ages out. Tell finance to hold pending payments and verify any recent bank-detail changes by phone.
Is business email compromise only a large-enterprise problem?
No. Small and midsize businesses are also affected, especially when email, cloud systems, remote access, backups and privileged accounts are not reviewed regularly.
Suspect a Compromised Mailbox? Talk to a CISO
Ali Hassani, CISSP and C|CISO, helps Southern California businesses on-site and clients nationwide remotely contain BEC incidents and close the Microsoft 365 gaps behind them.