Business email is central to everyday operations. Invoices, customer enquiries, confidential documents and account approvals often move through Outlook, Microsoft 365 or another email platform. That makes a compromised mailbox especially dangerous: an attacker may be able to read messages, impersonate employees or change payment instructions without immediately being noticed.
Business email compromise (BEC) is a form of fraud in which criminals exploit trusted business communications, often through a stolen account or convincing impersonation. Not every suspicious email means your mailbox has been hacked, but the warning signs below deserve prompt investigation.
If you suspect an active compromise: Contact your IT administrator or incident response provider using a trusted phone number or separate communication channel. Do not rely on the potentially compromised mailbox to coordinate your response.
1. Unexpected Login Alerts or Unfamiliar Account Activity
One of the earliest clues can be a sign-in notification you do not recognise. Examples include a login from an unfamiliar location, an unexpected multi-factor authentication (MFA) prompt or an alert about changes to account security settings.
Locations shown in security alerts are not always exact, particularly when VPNs or mobile networks are involved. The important question is whether the activity matches something the account owner actually did.
What to do
- Do not approve an MFA prompt you did not initiate.
- Contact your administrator to review recent sign-ins, devices and authentication methods.
- If unauthorised access is suspected, have the administrator block or restrict access, revoke active sessions and reset credentials using a trusted process.
- Check whether an attacker added an unfamiliar authentication method or recovery option.
2. Colleagues or Customers Receive Emails You Never Sent
A customer may call to ask about an unusual invoice, an unexpected attachment or a request to urgently transfer money. Sometimes suspicious messages appear in your Sent Items; in other cases, an attacker may delete them or use another technique to impersonate your address.
Look for messages with unusual language, unfamiliar links, unexpected payment instructions or requests to keep a transaction confidential.
What to do
- Warn affected contacts through a verified channel, such as a known telephone number.
- Ask recipients not to click links, open attachments or act on payment changes until verified.
- Preserve example messages, including full headers where possible, for investigation.
- Have your IT team check whether the emails originated from your actual account or were spoofed.
3. Emails Go Missing, Are Marked as Read or Are Secretly Forwarded
Attackers sometimes create mailbox rules that move messages into folders, delete replies or forward copies to an external address. This can help them watch financial conversations and conceal evidence of fraud.
Warning signs include customer replies disappearing, important messages being marked as read unexpectedly, or unfamiliar forwarding and inbox rules.
What to do
- Ask an administrator to review inbox rules, forwarding settings, delegates and mailbox permissions.
- Check whether external forwarding has been enabled without authorisation.
- Review relevant audit logs and mailbox activity where available.
- Remove malicious rules and permissions only as part of a coordinated response that preserves necessary evidence.
4. Your Password, MFA or Recovery Settings Change Unexpectedly
An attacker who gains account access may try to maintain it by adding a new authentication method, changing recovery information or granting access to an unfamiliar application. You might be locked out of your account or repeatedly asked to sign in.
Unexpected changes to Microsoft 365 security information, newly approved applications or unfamiliar devices should be treated seriously.
What to do
- Use a trusted device and contact your administrator immediately.
- Review account recovery details, registered MFA methods, app permissions and delegated access.
- Reset the password, revoke sessions and remove unauthorised access after the incident is contained.
- Investigate how the original access occurred so the same weakness is not left open.
5. Someone Requests a Sudden Change to Bank Details or an Urgent Payment
Payment redirection is one of the most costly outcomes of business email compromise. A criminal may enter an existing conversation with a customer or supplier and send new banking details that appear legitimate. The email may even come from a real account that has been taken over.
Be especially cautious when an invoice change is accompanied by pressure to act quickly, secrecy or an explanation that the usual contact is unavailable.
What to do
- Pause the transaction until the new instructions have been verified.
- Call the supplier or customer using a phone number already held in your records—not one supplied in the suspicious email.
- If a payment has already been sent, contact your bank's fraud team immediately and request an urgent recall or recovery attempt.
- Preserve the correspondence and escalate the incident internally.
Immediate Steps to Take if Your Business Email Is Compromised
The correct response depends on the systems involved and whether the attacker still has access. Your IT team should coordinate containment and evidence preservation rather than making changes at random.
Business email incident response checklist
- Report and escalate: Tell your IT administrator, managed IT provider or security incident response contact immediately.
- Contain access: Have an authorised administrator block suspicious sign-ins, revoke sessions and secure the account.
- Protect authentication: Reset credentials and remove unauthorised MFA methods, devices and app access.
- Inspect the mailbox: Check forwarding, inbox rules, delegates, sent messages and audit logs.
- Assess the impact: Determine which messages, files, contacts and financial transactions may have been exposed.
- Alert affected parties: Contact colleagues, customers and suppliers through verified channels when needed.
- Protect payments: Contact the bank urgently if any suspicious transfer has occurred.
- Preserve evidence: Keep logs, suspicious messages, timestamps and a record of response actions.
- Review reporting obligations: Consider whether privacy, contractual, regulatory or insurance notifications are required.
- Prevent recurrence: Address the entry point and strengthen account security and monitoring.
For Microsoft 365 environments, an administrator may need to investigate Entra ID sign-in logs, Exchange Online mailbox rules, audit events, registered authentication methods and application consent. Available logs and investigation tools depend on your configuration and licences.
Should You Report a Business Email Compromise in Australia?
Depending on the incident, Australian businesses may need to notify customers, regulators, insurers or law enforcement. Under Australia's Notifiable Data Breaches (NDB) scheme, covered organisations must assess suspected eligible data breaches and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when the legal threshold is met.
Businesses can also report cybercrime to ReportCyber via the Australian Cyber Security Centre. If money has been transferred fraudulently, contact the bank immediately rather than waiting for an investigation to finish. For legal and privacy obligations, seek advice appropriate to your circumstances.
How to Reduce the Risk of Business Email Compromise
Use phishing-resistant MFA where practical
MFA provides an important extra layer of protection. Phishing-resistant options such as passkeys or security keys can provide stronger protection than codes that users can be tricked into sharing. Protect administrator accounts especially carefully.
Set up reliable payment verification
Require independent verification for changes to supplier bank details, unusually large transfers and urgent payment requests. Staff should use a previously verified phone number and a second approver where appropriate.
Strengthen email and account controls
Use appropriate spam and phishing protection, restrict unnecessary mailbox forwarding, review delegated access and configure SPF, DKIM and DMARC for your domain. These controls help reduce impersonation risk but cannot eliminate every attack.
Monitor suspicious sign-ins and mailbox changes
Review alerts for risky sign-ins, unexpected MFA changes, new forwarding rules and unusual account behaviour. Clear escalation procedures matter just as much as having monitoring tools.
Train staff to recognise suspicious requests
Employees should know how to report unexpected MFA prompts, invoice changes and urgent requests. Make reporting straightforward and encourage early escalation—even when the employee is unsure whether an incident has occurred.
ITNetFix helps Sydney businesses review their security arrangements, support Microsoft 365 environments and improve business IT resilience. Explore our cybersecurity services, Microsoft 365 support, IT Support Sydney and backup and recovery services.
Frequently Asked Questions
Can a hacker access my email even if I use MFA?
Yes. MFA substantially reduces risk, but attackers may exploit stolen sessions, phishing techniques, compromised devices or weak account recovery settings. Review sign-ins and account security if you see suspicious activity.
Does changing my email password remove an attacker?
Not necessarily. An effective response may also require revoking active sessions, removing malicious inbox rules, reviewing authentication methods and checking connected applications or delegated access.
Can someone send fake emails without accessing my mailbox?
Yes. Email spoofing and lookalike domains can make a message appear to come from your organisation. Investigating headers and authentication results can help distinguish impersonation from an actual account takeover.
What should I do if a supplier's bank details change by email?
Do not rely on the email alone. Verify the change by calling a known contact using a previously established number and follow your organisation's payment approval procedure.
Should I notify my cyber insurer?
Check your policy's incident notification conditions promptly. Some policies require early notice and may specify approved response providers. Your broker or insurer can clarify the applicable requirements.
How can a managed IT provider help?
A provider can help investigate suspicious activity, contain compromised accounts, restore secure access, review Microsoft 365 settings and strengthen preventive controls. The exact incident response scope depends on your service agreement.
Final Thoughts
A compromised business mailbox can affect more than one employee. It can put customer information, supplier relationships and payments at risk. The earlier your team identifies suspicious activity, the more options you may have to contain the incident and limit damage.
Make sure employees know what to report, who to call and how to verify sensitive requests. Strong account security, independent payment checks and a rehearsed response process can make a meaningful difference.
Concerned About Business Email Security?
ITNetFix supports Sydney businesses with Microsoft 365, cybersecurity, managed IT services and business IT support. Contact our team to discuss email security controls, suspicious activity or improvements to your IT environment.
Talk to ITNetFix About Email Security →