How email compromise happens
Business email compromise is when a criminal gets into a real mailbox, or convincingly imitates one, to steer money or data their way. A typical case: someone enters their password on a fake Microsoft page, the attacker signs in quietly, sets a hidden rule to hide replies and waits. When an invoice thread appears, they send new bank details from the real account. The payment goes out and nobody notices for days.
It is one of the costliest forms of cybercrime for small businesses, and it needs no malware at all.
Locking down Microsoft 365
Most of the defense lives in settings:
- Multi-factor authentication for every account, with legacy sign-in methods blocked.
- Conditional access rules where your licenses allow them.
- Anti-phishing and impersonation protection tuned for your executives and finance staff.
- External sender tags so outside mail is obvious.
- Limits on automatic forwarding to outside addresses.
Watching for takeover signs
We monitor for the signals that a mailbox is in the wrong hands: sign-ins from unusual places, new inbox rules that hide or forward mail, sudden mass sending and changes to security settings. During office hours an engineer investigates alerts and acts, locking the account, revoking sessions and removing malicious rules.
Payment fraud habits
Technology cannot catch every fake invoice, so we help you set simple habits. The most important: any change to payment details is confirmed by phone, using a number you already have, never one from the email. We build that into security awareness training for the people who pay bills.
Learn the warning signs
Our guide to business email compromise warning signs lists what to look for and what to do in the first hour after a suspected takeover.
Protecting your domain: SPF, DKIM and DMARC
Criminals do not need your password to send email that looks like it came from you. Three DNS records make that much harder. SPF lists the services allowed to send mail for your domain, DKIM adds a signature that proves a message was not changed, and DMARC tells receiving mail servers what to do with messages that fail those checks. We set up all three, read the DMARC reports to find legitimate senders you forgot about, such as a billing platform or a marketing tool, and then move the policy to quarantine or reject so spoofed mail is stopped. Major mailbox providers now expect these records from businesses that send in volume, so they also help your real email reach inboxes.
What we do when a mailbox is compromised
Speed and order matter. We reset the password and end every active session, check that MFA is on and that the attacker has not added their own method, remove any forwarding or hiding rules they created and review sign-in logs to see where they came from. Then we search sent items and audit logs to learn who received messages from the account and what the attacker could read, warn the people they targeted and help you decide whether the exposure triggers a notice duty. Our guide to business email compromise warning signs covers what your team should do in the first minutes.
Scams to know about
- Fake invoices and changed bank details from a vendor account that was hacked or imitated.
- Gift card requests that appear to come from the owner or a manager.
- Payroll diversion, where an “employee” asks HR to change their direct deposit.
- Fake Microsoft 365 login pages, often reached through a shared document link or a QR code.
- Callback scams, where a fake renewal notice asks the reader to phone a “support” number.
Each one relies on trust and urgency, which is why technical controls and simple verification habits work best together.
Training staff to spot what filters miss
No filter catches every message, especially one sent from a real vendor account that was taken over. Short security awareness training and phishing practice teach people the clues to look for: a slightly wrong sender address, a request that skips the usual process, urgency, secrecy and links that lead to login pages. A Report button in Outlook lets anyone flag a suspicious message in one click, and every report helps us block similar mail for everyone.
Where we work
We protect email for businesses in 20 major US cities and other US cities, as part of full managed IT.