Business Email Compromise Response Checklist: First 24 Hours

If you know or suspect a business email compromise (BEC) has occurred, you are in a race against the attacker. The first 24 hours are a critical window to contain the breach, cut off the attacker's access, and begin assessing the scope of the damage. Acting quickly and methodically can make the difference between a contained incident and a catastrophic financial or data loss.

This checklist is designed for the immediate, tactical response. It focuses on the first steps you must take to stabilize the situation. Broader strategic actions, like fulfilling legal notification requirements or implementing long-term security improvements, will follow. For now, the priority is to stop the bleeding.

If you are in an active crisis, contact our 24/7 BEC incident response team now at business email compromise.

First 24 Hours: Your Immediate BEC Response Checklist

When an email account is compromised, attackers typically move with speed. They aim to exploit the account for financial gain through wire fraud, redirecting payments, or stealing sensitive data before they are discovered. Your goal is to move faster. The following steps should be performed as quickly as possible.

1. Preserve Evidence. Then, Contain the Compromised Account(s).

Your first instinct may be to immediately reset the password. Wait. Before you do anything that could alter the state of the account, you must preserve evidence. This is crucial for the eventual investigation. An experienced incident response team can often determine the attacker's actions, what they saw, and what they stole, but only if the digital footprints are still there.

Do Not Delete Anything: Do not delete emails, logs, or change mailbox configurations (like forwarding rules) until you have a copy.
Export Logs: If you have the capability, export the Microsoft 365 Unified Audit Log and Entra ID (formerly Azure Active Directory) sign-in and audit logs for the affected user, going back at least 90 days. Note that log retention depends on your licensing.
Screenshot Malicious Activity: Take screenshots of suspicious sign-ins, inbox rules you don't recognize, or sent emails you didn't write.

Once you have taken basic preservation steps, contain the account to lock out the threat actor.

Reset the Password: Choose a long, complex, and unique new password.
Revoke Active Sessions: A password reset alone is not enough. The attacker may have an active session token that allows them to remain logged in. In Microsoft 365, use the Admin Center or PowerShell to "Sign out of all sessions" for the user account. This forces re-authentication on all devices.
Enable Multi-Factor Authentication (MFA): If MFA was not already enabled on the account, turn it on immediately. Use a strong method like an authenticator app, not SMS. If MFA was already on, the attacker may have bypassed it through a technique like MFA fatigue or token theft. The investigation will need to uncover how. MFA is a powerful defense, but not infallible.

2. Hunt for Attacker Persistence and Reconnaissance

Attackers don't just guess passwords; they plan their attacks. Once inside, they set up mechanisms to maintain access and study your environment to prepare for their ultimate goal, which is usually financial fraud. You must find and disable these mechanisms.

Check for Malicious Inbox Rules: This is the most common persistence method. Attackers create inbox rules that auto-forward copies of sensitive emails (like those containing words like "invoice," "payment," or "wire") to their own external email address. They may also set rules to auto-delete their own sent messages to hide their tracks. Learn how to find and stop unauthorized email forwarding rules.
Review Mailbox Permissions: Attackers can grant themselves or other mailboxes "Full Access" or "Read" permissions to the compromised mailbox, giving them another way to monitor activity.
Scrutinize Sent Items and Deleted Items: Look for emails sent by the attacker. Check the "Deleted Items" and "Recoverable Items" folders, as attackers often delete their sent messages. The content of these emails can reveal their entire game plan.
Inspect for New Applications: In Entra ID, check for any new "Enterprise Applications" that have been granted consent. Attackers can trick users into consenting to malicious apps that can read email and other data via the Microsoft Graph API.

3. Triage for Financial Fraud

Business email compromise is almost always financially motivated. The primary goal is often to trick your company, its customers, or its vendors into sending money to an account controlled by the attacker. This requires immediate triage.

Contact Your Bank Immediately: If you know or suspect funds have been wired to a fraudulent account, this is your top priority. Call your bank's fraud department directly. Time is of the essence. A wire transfer can sometimes be recalled or reversed by the financial institution, but only if you act within hours.
Notify AP and AR Teams: Alert your accounts payable and accounts receivable departments. Instruct them to verbally verify all pending and future payment instructions and changes to banking details. Do not trust an email request alone.
Review Recent Communications: Analyze the compromised mailbox for any conversation involving invoices, payments, or changes to bank accounts. Look for manipulated PDFs or wire instructions. The attacker may have intercepted a legitimate invoice and edited the banking details. This is known as Vendor Email Compromise (VEC).
Report to the FBI: File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. The IC3 has a Recovery Asset Team that can sometimes work with the destination bank to freeze stolen funds, but again, speed is critical.

For a deeper dive on this topic, see our guide on what to do after a wire fraud incident.

4. Begin the Investigation

Once the immediate containment is done, the investigation begins. The goal is to understand the "who, what, when, where, and how" of the attack.

Determine the Initial Entry Point: How did the attacker get in? Was it a phishing email, a brute-force password spray attack, or something else? The Entra ID sign-in logs will provide clues, showing IP addresses, locations, and authentication methods. Understanding how BEC happens is key to preventing it.
Establish the Timeline: When did the first unauthorized sign-in occur? How long was the attacker in the account before being discovered? This timeline is critical for understanding the period of exposure.
Assess Data Exposure: What did the attacker access? The Unified Audit Log in Microsoft Purview can show which emails were read, downloaded, or forwarded. This step is vital for determining if a notifiable data breach occurred. Simply having an email account compromised can constitute a data breach depending on the sensitivity of the data in the mailbox.

When Should You Call for Incident Response Help?

While some organizations can handle the initial steps internally, an external incident response firm is often necessary to ensure the recovery is complete and defensible. The stakes are too high to risk missing a step or failing to eradicate the attacker completely.

Consider bringing in a firm like Lyra Recovery if:

You suspect financial loss has already occurred.
You lack the in-house expertise or tools to conduct a thorough forensic investigation of Microsoft 365 or Google Workspace logs.
The attacker has been in the environment for an extended period.
Multiple accounts are compromised.
You have regulatory, contractual, or cyber insurance obligations that require a formal investigation and report. These requirements can be complex and vary by jurisdiction and industry. Understanding your reporting obligations is critical.
You need to be certain the attacker is gone and cannot get back in.

An experienced team can move much faster and more decisively than an internal team pulled from their daily duties. We use specialized tools and a proven BEC incident response playbook to rapidly investigate, contain, and remediate the compromise.

Frequently Asked Questions

Should I tell my employees about the email compromise?

Yes. You should communicate clearly with your staff, especially those in financial roles. Warn them about the incident and instruct them to be on high alert for suspicious emails. All requests for payments or changes to financial information must be verified through a secondary channel, such as a phone call to a known number.

How do I know if the attacker accessed other accounts?

You must analyze sign-in and audit logs for other users, looking for the same suspicious indicators (e.g., IP addresses, user agents) found in the initial compromised account. Attackers often attempt to move laterally to accounts with higher privileges. This is why a broader breach hunting exercise is a key part of a full response.

Does resetting the password get the hacker out?

Not always. As noted above, a password reset alone does not terminate active login sessions. You must explicitly revoke all sessions in the Microsoft 365 or Google Workspace admin center. Failing to do so is one of the most common and critical mistakes in BEC response, allowing the attacker to remain in the account even after a password change.

Our cyber insurance policy might cover this. What should I do?

Review your policy and contact your insurance carrier immediately using the provided breach hotline number. Most policies have specific requirements about which vendors you can use for incident response and legal counsel, and failing to follow their process can jeopardize your coverage. Learn more about cyber insurance requirements after a breach.

The first 24 hours of a business email compromise are chaotic and stressful. This checklist provides the immediate, high-priority actions needed to regain control. Once you have stabilized the environment, the focus will shift to a more detailed investigation, hardening your defenses, and full recovery. For a comprehensive overview of the entire process, see our Business Email Compromise Recovery Guide.

If you need expert guidance to navigate this crisis, contain the threat, and secure your environment, our team is ready to assist. Contact the Lyra Recovery 24/7 incident response team for immediate help with your business email compromise investigation.