Business email compromise · Australia · answered 24/7
Someone else is inside your business email.
Mail you didn't send, a customer who paid an invoice that wasn't yours, sign-in alerts from another country. Business email compromise is quiet by design, and the attacker is usually still in the mailbox when you find out. The first job is getting them out properly.
A password reset on its own won't do it. Sessions, consented apps and the MFA methods they added all survive one. Australian business incident response for Microsoft 365, any hour.
This service is for businesses and organisations. If your personal email or bank account has been compromised, report it via ReportCyber and contact IDCARE.
If money has already moved
- Call your bank firstAsk the fraud team for a recall today. It works best before the funds are moved on, and it doesn't need to wait for the investigation.
- Report itLodge a ReportCyber report. Your bank may ask for the reference number when it processes a recall.
- Confirm by phoneRing the other party on a number you already had. Don't rely on any contact details from the email thread.
Attackers threatening to publish data they took? That is a different job: data theft extortion response.
Just found out?
The first hour. Lock them out, then find out what they did.
Do
- If money went to a changed account, ring your bank's fraud line now and ask for a recall. Recalls work best in the first hours, before the funds are moved on.
- Reset the password and revoke every active session for the affected account. A reset alone leaves the attacker's existing sign-in token working.
- Check inbox rules and forwarding. Look for rules that move, delete or mark as read anything mentioning invoices or payments, and for forwarding to an outside address. Screenshot them, then remove them.
- Check the MFA methods on the account and remove any phone or authenticator app you don't recognise. Attackers add their own so they can get back in.
- Review OAuth app consents. A third-party app granted access to the mailbox keeps reading mail after the password changes.
- Phone the customers and suppliers in the thread. Warn them not to act on bank details sent by email, and do it by phone, not from the affected mailbox.
Don't
- Don't stop at the password reset. The attacker's live sessions survive it, and so do any apps or MFA methods they added.
- Don't delete the mailbox, the account or the rules before recording them. They are the evidence of what happened and who was exposed.
- Don't warn people from the compromised account. The attacker may still be reading it, and may answer for you.
- Don't pay a "corrected" invoice until you have confirmed the new bank details by phone, on a number you already had.
How to tell it's BEC
It rarely looks like an attack. It looks like normal mail.
Attackers who get into a mailbox tend to wait. They read the threads, learn who pays whom, and step in when an invoice is due. These are the signs that usually surface first:
A customer paid an invoice you never sent
Or a supplier says their account details changed and the email came from a real thread. Payment redirection is the most common end point of a business email compromise, and it is often how people first find out.
Mail you didn't send, or replies you never saw
Colleagues ask about a message you didn't write, Sent Items has gaps, or replies to a thread go missing. Attackers hide their conversation with rules that file the replies away from the inbox.
Sign-ins and MFA prompts you can't explain
Sign-in alerts from another country, MFA prompts nobody triggered, or a new authenticator registered on the account. Any of these on its own is worth an investigation.
Rules or forwarding nobody set up
An inbox rule with a one-character name, a rule that moves mail to RSS Feeds or Archive, or forwarding to a free webmail address. These are almost always deliberate.
Not sure whether someone got into a mailbox or just sent mail pretending to be you? Those are different problems. The free email security checker shows in seconds whether your domain can be spoofed.
Microsoft 365
Where the evidence lives, and how long it stays.
Most Australian business mail runs on Microsoft 365, and the usual way in is a phishing page that captures the session token along with the password and MFA code. That is why the attacker gets in without tripping MFA, and why ending sessions matters more than the reset.
Some of these logs expire in days. Export them before anyone starts cleaning up, because what they show decides who was exposed and what you have to report.
Entra ID sign-in logs
Unfamiliar IP addresses and countries, legacy authentication, and sign-ins that succeeded after an MFA prompt. Retention is 7 days on the free tier and 30 on P1 or P2, so export them first.
Exchange inbox rules and forwarding
Rules on the affected mailbox, mailbox-level forwarding, and tenant-wide mail flow rules. An attacker with admin access can forward mail at the tenant level where no user ever sees it.
Enterprise apps and consent grants
Apps the user consented to with mail permissions, and any app registrations created recently. Removing consent is part of locking them out.
Authentication methods
Phone numbers, authenticator apps and passkeys registered on the account, with the date each was added.
Purview audit log
What the attacker did once inside: rules created, messages sent, and, where your licensing records it, which messages were read. This is what the Notifiable Data Breaches assessment rests on.
Admin roles and delegations
New global admins, mailbox delegations and send-as permissions. If any changed, treat it as a tenant compromise, not a single mailbox.
Who you need to tell
A mailbox is full of personal information. That makes it a reporting question.
Even when no money moved, an attacker with access to a mailbox had access to whatever was in it. Four parties usually need to hear about it:
Notifiable Data Breaches assessment
A mailbox nearly always holds personal information. If an attacker had access to it, you have 30 days to assess whether the breach is likely to cause serious harm, and to notify the OAIC and the people affected if it is.
Your bank, and the other party's bank
For a redirected payment, both banks need to know quickly. Yours requests the recall; theirs can freeze the receiving account if it acts in time.
ReportCyber
Report the incident to the Australian Cyber Security Centre through ReportCyber. Your bank may ask for the reference when it processes a recall.
Your cyber insurer
Most policies require prompt notice and some require you to use their panel. Check before engaging anyone, so the response is covered.
Detail on the assessment: the NDB scheme. Once it is contained, the change that stops the most common way in is phishing-resistant MFA. General guidance, not legal advice.
What is business email compromise?
Business email compromise (BEC) is when an attacker gets into a business mailbox, usually in Microsoft 365, and uses it to read mail, send mail as you, or sit quietly in a conversation until money is due. The common goal is payment redirection: an invoice goes out, or comes in, with the attacker's bank details on it. Because the message comes from a real account in a real thread, it is much harder to spot than ordinary phishing.
We changed the password. Is that enough?
Usually not. Changing the password does not end sessions the attacker already has, does not remove apps they consented to, and does not remove an authenticator they added. Revoke all sessions, review the MFA methods and app consents, and remove the inbox rules. Then check whether anything changed at the tenant level, such as new admin roles or mail flow rules.
A payment went to the wrong account. Can we get it back?
Sometimes, and speed is the deciding factor. Call your bank's fraud team straight away and ask for a recall, then report it through ReportCyber. If the funds are still in the receiving account, the receiving bank can freeze them. Once they have been moved on, recovery becomes much less likely. We handle the investigation alongside this, but the call to the bank should not wait for us.
How did they get past our MFA?
Most often through adversary-in-the-middle phishing. The user signs in through a convincing fake Microsoft page that passes the details to the real one, MFA included, and captures the session token that comes back. The attacker then uses that token without ever needing the password or the code. Phishing-resistant methods such as passkeys and security keys stop this, because they will not authenticate to the wrong site.
Do we have to report a business email compromise?
If the mailbox held personal information and the attacker could have accessed it, the Notifiable Data Breaches scheme applies. You have 30 days to assess whether serious harm is likely, and if it is, you notify the OAIC and the affected people. Customer details, staff records, bank details and identity documents in attachments all count. Our guide to the NDB scheme covers the assessment and what goes in the statement. General guidance, not legal advice.
Was our mailbox actually compromised, or was our domain just spoofed?
They look similar from the outside and are very different problems. Spoofing means someone sent mail pretending to be your domain, without getting into any account. Compromise means they were inside a mailbox. The sign-in and audit logs answer it. If your domain can be spoofed at all, the free email security checker will show it in a few seconds.
Our IT provider manages Microsoft 365. Can you still help?
Yes. We work alongside your IT provider rather than around them: they keep the environment, we lead the investigation, preserve the evidence and give both of you a report structured for your insurer and the NDB assessment.
What does IronSights do on a business email compromise?
Lock the attacker out properly, trace what they read, sent and changed, find out how they got in, and check the rest of the tenant for anything they left behind. You get a report that sets out who was exposed, written so your NDB assessment can rest on it, and a short list of changes so it does not happen the same way twice.
Answered 24/7
Get them out, and know what they saw.
We close every way back in, trace what was read, sent and changed, and give you a report your insurer and your NDB assessment can both work from.