Incident Response and Digital Forensics
Business Email Compromise Investigation
We track what the attacker read, sent and forwarded in the compromised mailbox. We provide evidence of how the fake payment instruction was prepared and who received it.
What it is
In business email compromise (BEC), the attacker uses the real mailbox of an employee or supplier. They usually read correspondence first and wait for a suitable payment moment. Then they insert a payment instruction with altered bank details into an ongoing thread. The investigation uses mail service logs to determine how the account was compromised and what the attacker did.
Scope
- Determining how the account was compromised
- Identifying inbox rules and forwarding set up by the attacker
- Identifying from logs which messages were read, sent or deleted
- Removing malicious app consents and open sessions
- Determining which threads and recipients received the fake instruction
- Detecting fake messages sent from lookalike domains
The need
When organizations need it
- When a supplier reports an invoice unpaid and payment has gone to a new account.
- When your customers receive invoices in your name with changed bank details.
- When an employee notices replies to messages they did not send.
Method
How we work
-
Initial measures
We first collect rules and logs as evidence. Then we close sessions and reset access.
-
Entry method
We determine from sign-in logs when and how the account was compromised.
-
Mailbox activity
We extract from audit logs the messages read, sent and deleted, and rules added.
-
Impact
We report who received the fake instruction and which personal data was accessed.
Outcome
What you have at the end
You know what the attacker did in the mailbox and when, and who received the fake instruction. Technical details are ready for your bank, counterparties and any breach notification.
Frequently asked questions
If money has already been sent, what should we do first?
Call your bank immediately and request the transfer be stopped or recalled. Time is critical at this step. The technical investigation can begin in parallel.
Can you say exactly which emails were read?
This depends on whether mailbox access logging was enabled and how long it is retained. If those records are missing, all messages the attacker could access may need to be considered as read.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting