Business email compromise in Microsoft 365 rarely looks like a dramatic hack. There is no ransom note and no locked screen. There is just a normal-looking email thread, a slightly changed bank account number, and a payment that goes to the wrong place. By the time anyone notices, the money has often moved on.
Understanding how the attack actually unfolds, step by step, is the best way to see where your defenses need to be. This article walks through a typical business email compromise (BEC) attack against a Microsoft 365 tenant and the controls that break each stage.
Stage 1: getting in
Attackers need access to a mailbox, or a convincing imitation of one. The common routes are:
Credential phishing: a fake “shared document” or “voicemail” link that leads to a lookalike Microsoft sign-in page.
Adversary-in-the-middle phishing: a more advanced version that relays the real Microsoft sign-in, including the MFA prompt, and steals the session token afterward. This is how attackers get past push or code-based MFA.
Password spray: trying a few common passwords against many accounts, aimed at accounts without MFA or protocols that cannot do MFA.
No access at all: some BEC uses a lookalike domain, like a supplier’s name with one letter changed, and never touches your tenant.
What breaks this stage: MFA for every user, blocking legacy authentication, and phishing-resistant MFA (passkeys or FIDO2 keys) for admins and finance staff. Conditional Access that requires a compliant device makes a stolen password or token far less useful. Conditional Access needs Microsoft Entra ID P1, included in Business Premium.
Stage 2: staying in
Once inside, the attacker wants to keep access even if the password is changed. In the incidents I review, the common persistence tricks are:
Malicious inbox rules that move or delete messages containing words like “invoice”, “payment”, or the name of the person being impersonated, so the real user never sees replies.
External forwarding that copies every message to an outside address.
A new MFA method registered to the attacker’s phone.
A consented OAuth app with permission to read mail, which keeps working after a password reset.
What breaks this stage: blocking automatic external forwarding in the outbound anti-spam policy, restricting user consent to apps in Microsoft Entra ID, and alerting on new inbox rules and new MFA registrations. Microsoft Defender XDR includes alerts for suspicious inbox manipulation and forwarding, but someone has to be watching them.
Stage 3: watching and learning
This is the stage most people do not expect. A patient attacker may sit in a mailbox for days or weeks, reading. They are looking for:
Who approves payments, and how
Which suppliers send invoices, how often, and in what format
Upcoming large transactions, such as a property closing, an equipment purchase, or a legal settlement
The writing style of the person they will impersonate
They often search the mailbox for words like “wire”, “invoice”, “bank”, and “W-2”.
This quiet period is also the best chance you have to catch them. Nothing has been stolen yet, and the signals are there if someone is looking: a sign-in from an unfamiliar country, a new device, a session from a hosting provider rather than a home or office connection. The longer an attacker reads undetected, the more convincing their eventual request will be.
What breaks this stage: Microsoft Entra ID Protection (Entra ID P2) can flag risky sign-ins, such as impossible travel or anonymous IP addresses. Mailbox auditing in Microsoft Purview records actions like mail searches and folder access, which matters for the investigation later. A managed detection service that reviews sign-in anomalies is what usually catches an attacker here, before money moves.
Stage 4: the ask
With enough context, the attacker makes their move. The message usually looks like one of these:
Scenario
What it looks like
Red flag
Supplier invoice fraud
A reply in a real invoice thread: “Our bank has changed, please use the details attached.”
Any change to payment details by email
Executive request
“I am in a meeting, need you to process a payment today, keep this quiet.”
Urgency plus secrecy
Payroll diversion
An “employee” asks HR to update their direct deposit account
Payroll changes requested only by email
Client closing funds
Updated wire instructions just before a real estate or legal closing
Last-minute instruction changes
Because the message often comes from the real mailbox, inside a real thread, it passes SPF, DKIM, and DMARC. Email filtering helps less here. Process is the control.
What breaks this stage: a written rule that any change to payment details is verified by phone using a number already on file, never a number in the email. Mail flow rules that add a warning banner to external messages mentioning payment changes help people pause. Defender for Office 365 impersonation protection, configured through the Standard or Strict preset security policies, catches many lookalike-domain attempts.
Stage 5: cash-out and cleanup
The money is moved quickly, often through several accounts. The attacker may delete sent items and replies, or simply leave the inbox rules running to hide responses. Sometimes they use the compromised mailbox to send phishing to your clients and suppliers, starting the cycle again at another business.
What helps now: speed. Contact your bank immediately, since recall is sometimes possible within a short window. Then follow an incident response process: revoke sessions, reset credentials, remove malicious rules and apps, and review the audit log to understand what was read and sent. Audit logging has to be turned on before the incident for this to work.
A layered defense that fits a small business
Enforce MFA for everyone and block legacy authentication.
Use phishing-resistant MFA for admins, finance, and executives.
Require compliant devices with Intune and Conditional Access.
Turn off automatic external forwarding tenant-wide.
Restrict user consent to third-party apps.
Apply the Standard preset security policy to all users and Strict to high-value targets.
Confirm audit logging is on.
Adopt a call-back rule for every payment detail change.
Train staff on what BEC messages look like, using realistic examples.
MFA stops most password-based attacks, which removes a large share of BEC. It does not stop adversary-in-the-middle phishing that steals session tokens, or BEC that uses a lookalike domain. Phishing-resistant MFA and compliant device requirements close much of that gap.
Why did our email filter not catch the fraudulent message?
When the attacker sends from a real compromised mailbox inside a real conversation, the message is technically legitimate. It passes authentication checks. That is why payment verification processes matter as much as technology.
What is the first thing to do if we suspect BEC?
If money has been sent, call your bank first. Then secure the account: reset the password, revoke sessions, and check for inbox rules, forwarding, and new MFA methods. Preserve the audit logs before making large changes.
Want to know how exposed your tenant is to business email compromise? Book a free Microsoft 365 security assessment and we will check every stage covered here.
Business email compromise in Microsoft 365 rarely looks like a dramatic hack. There is no ransom note and no locked screen. There is just a normal-looking email thread, a slightly changed bank account number, and a payment that goes to the wrong place. By the time anyone notices, the money has often moved on.
Understanding how the attack actually unfolds, step by step, is the best way to see where your defenses need to be. This article walks through a typical business email compromise (BEC) attack against a Microsoft 365 tenant and the controls that break each stage.
Stage 1: getting in
Attackers need access to a mailbox, or a convincing imitation of one. The common routes are:
What breaks this stage: MFA for every user, blocking legacy authentication, and phishing-resistant MFA (passkeys or FIDO2 keys) for admins and finance staff. Conditional Access that requires a compliant device makes a stolen password or token far less useful. Conditional Access needs Microsoft Entra ID P1, included in Business Premium.
Stage 2: staying in
Once inside, the attacker wants to keep access even if the password is changed. In the incidents I review, the common persistence tricks are:
What breaks this stage: blocking automatic external forwarding in the outbound anti-spam policy, restricting user consent to apps in Microsoft Entra ID, and alerting on new inbox rules and new MFA registrations. Microsoft Defender XDR includes alerts for suspicious inbox manipulation and forwarding, but someone has to be watching them.
Stage 3: watching and learning
This is the stage most people do not expect. A patient attacker may sit in a mailbox for days or weeks, reading. They are looking for:
They often search the mailbox for words like “wire”, “invoice”, “bank”, and “W-2”.
This quiet period is also the best chance you have to catch them. Nothing has been stolen yet, and the signals are there if someone is looking: a sign-in from an unfamiliar country, a new device, a session from a hosting provider rather than a home or office connection. The longer an attacker reads undetected, the more convincing their eventual request will be.
What breaks this stage: Microsoft Entra ID Protection (Entra ID P2) can flag risky sign-ins, such as impossible travel or anonymous IP addresses. Mailbox auditing in Microsoft Purview records actions like mail searches and folder access, which matters for the investigation later. A managed detection service that reviews sign-in anomalies is what usually catches an attacker here, before money moves.
Stage 4: the ask
With enough context, the attacker makes their move. The message usually looks like one of these:
Because the message often comes from the real mailbox, inside a real thread, it passes SPF, DKIM, and DMARC. Email filtering helps less here. Process is the control.
What breaks this stage: a written rule that any change to payment details is verified by phone using a number already on file, never a number in the email. Mail flow rules that add a warning banner to external messages mentioning payment changes help people pause. Defender for Office 365 impersonation protection, configured through the Standard or Strict preset security policies, catches many lookalike-domain attempts.
Stage 5: cash-out and cleanup
The money is moved quickly, often through several accounts. The attacker may delete sent items and replies, or simply leave the inbox rules running to hide responses. Sometimes they use the compromised mailbox to send phishing to your clients and suppliers, starting the cycle again at another business.
What helps now: speed. Contact your bank immediately, since recall is sometimes possible within a short window. Then follow an incident response process: revoke sessions, reset credentials, remove malicious rules and apps, and review the audit log to understand what was read and sent. Audit logging has to be turned on before the incident for this to work.
A layered defense that fits a small business
Our managed security service watches for the sign-in and mailbox signals that reveal an attacker in stages 2 and 3. For the email layer, see Defender for Office 365, and for the human layer, security awareness training. Microsoft’s guidance on responding to a compromised email account lists the common warning signs.
Frequently asked questions
Does MFA stop business email compromise?
MFA stops most password-based attacks, which removes a large share of BEC. It does not stop adversary-in-the-middle phishing that steals session tokens, or BEC that uses a lookalike domain. Phishing-resistant MFA and compliant device requirements close much of that gap.
Why did our email filter not catch the fraudulent message?
When the attacker sends from a real compromised mailbox inside a real conversation, the message is technically legitimate. It passes authentication checks. That is why payment verification processes matter as much as technology.
What is the first thing to do if we suspect BEC?
If money has been sent, call your bank first. Then secure the account: reset the password, revoke sessions, and check for inbox rules, forwarding, and new MFA methods. Preserve the audit logs before making large changes.
Want to know how exposed your tenant is to business email compromise? Book a free Microsoft 365 security assessment and we will check every stage covered here.