Business Email Compromise Forensics Guide

Business email compromise (BEC) is the fraudulent takeover or spoofing of a trusted email account to divert payments, harvest data, or manipulate people inside an organization. A forensic BEC investigation reconstructs how the attacker gained access, what they touched, and how long they persisted — using mailbox audit logs, sign-in records, mail-flow rules, and OAuth grants. Speed matters: the cloud logs that prove the intrusion expire on fixed schedules, and once they are gone, the truth goes with them.

Business email compromise is, by financial impact, the most damaging category of cybercrime most organizations will ever face — the FBI’s Internet Crime Complaint Center (IC3) has for years ranked it among the costliest, with losses measured in the billions of dollars annually. Yet it rarely arrives as a dramatic breach. There is no ransomware note, no encrypted drives, no obvious alarm. Instead a wire goes to the wrong account, a vendor complains about an invoice no one recognizes, or a payroll deposit vanishes — and only then does anyone look at the mailbox. This guide is written for the executive, general counsel, controller, or family-office principal who has to understand what a world-class BEC investigation actually involves: how attackers get in and stay hidden, why the clock on evidence is unforgiving, and what separates a defensible forensic reconstruction from a hopeful guess.

What makes business email compromise a forensic problem, not just an IT ticket?

The instinct after a BEC event is to reset the password, breathe out, and move on. That instinct is exactly how organizations lose the case. BEC is a forensic problem because the questions that matter — and the questions a bank, an insurer, a regulator, or a court will ask — cannot be answered by a password reset. Which account was compromised, and when? How did the attacker get in? What did they read, forward, or exfiltrate? Did they reach other mailboxes or systems? Are they still inside? Was regulated or privileged data exposed? Each answer lives in log data that is time-limited, easily contaminated, and trivially destroyed by well-meaning remediation.

The distinction that separates professionals from improvisers is the same one that governs all of digital forensics: evidence must be preserved before it is analyzed, and analyzed before the environment is changed. Resetting credentials, deleting malicious inbox rules, and revoking sessions are all necessary — but done before preservation, they overwrite the very record that proves what happened. A mature response holds those two objectives in tension: contain the attacker quickly enough to stop the bleeding, without destroying the audit trail that makes recovery, insurance recovery, and any eventual legal action possible.

How do attackers get in, and how do they stay hidden?

Most BEC intrusions begin with stolen credentials — usually harvested through a phishing page that mimics a Microsoft 365 or Google Workspace login, or replayed from a prior breach. Increasingly, attackers use adversary-in-the-middle phishing kits that capture the session token itself, sidestepping multi-factor authentication entirely because they inherit an already-authenticated session. Once inside, the sophisticated actor’s goal is not noise but silence. They establish persistence and quiet control, then wait and watch for a payment they can redirect.

Two techniques dominate the forensic picture, and understanding them tells you where the evidence lives:

• Malicious mailbox rules (rule harvesting). The attacker creates hidden inbox rules that auto-forward, move, or delete messages — for example, silently routing every email containing “invoice,” “wire,” “payment,” or “ACH” to an obscure folder, the RSS Feeds folder, or straight to deletion, so the real user never sees the fraud unfolding in their own inbox. A related move is an auto-forward rule that copies inbound mail to an external address, giving the attacker an ongoing feed even after a password reset. These rules are small, easily missed, and among the most reliable forensic fingerprints of a compromise.
• OAuth token and application-consent abuse. Rather than rely on a password that might be changed, attackers trick a user into granting a malicious third-party application persistent, token-based access to the mailbox — or register a rogue application in the tenant. Because OAuth access tokens and refresh tokens are independent of the password, revoking the password does not revoke them. The attacker retains access through the granted scope until the consent and tokens are explicitly revoked, which is why so many organizations that “cleaned up” a BEC find the intruder still reading mail weeks later.

Other persistence and reconnaissance behaviors round out the pattern: adding secondary MFA methods or trusted devices under the attacker’s control, delegating mailbox permissions, and probing the address book to plan the next hop. A competent investigation assumes all of these until it can rule each one out — because BEC actors rarely rely on a single foothold.

Which forensic artifacts actually prove a BEC intrusion?

A defensible reconstruction is built from a specific set of cloud artifacts, correlated across time. The table below maps the primary sources in the two dominant platforms — what each reveals and, critically, how long it typically survives by default. Retention varies by license tier and configuration, and these windows are the single most important operational fact in any BEC response.

Evidence source	What it reveals	Typical default window
Microsoft 365 Unified Audit Log	Sign-ins, rule creation, consent grants, mailbox access, admin actions	90 days (Standard); up to 1 year+ with E5 / premium licensing
M365 mailbox audit log	Message reads, moves, deletions, delegate access per mailbox	90 days by default
M365 message trace	Inbound/outbound mail flow, forwarding, delivery paths	~90 days (detailed trace shorter)
Entra ID sign-in logs	IP, geolocation, device, MFA result, token issuance	~30 days (longer with premium / SIEM export)
Google Workspace login audit	Successful/failed logins, IP, suspicious-activity flags	~6 months
Google Workspace admin audit	Delegation, forwarding config, app grants, policy changes	~6 months
Gmail email log search	Message-level delivery and routing detail	~30 days
OAuth app grants / token report	Third-party apps with mailbox access and their scopes	Current-state (snapshot; preserve immediately)

Read that table as a countdown. In a default-licensed Microsoft tenant, the sign-in detail that proves where the attacker logged in from may be gone in roughly a month; in Google Workspace, the granular Gmail delivery record can lapse in about thirty days. An investigation that starts six weeks after the fraud is often reconstructing from ashes. This is why the first professional act in any BEC matter is not analysis — it is preservation.

Why do log preservation windows decide the outcome?

Preservation is the hinge on which every BEC investigation turns. Unlike a hard drive, which sits inert until someone alters it, cloud audit logs are actively aging out on the provider’s schedule whether or not anyone is looking. Every day between the intrusion and the preservation order is a day of evidence potentially deleted by the vendor’s own retention policy — not maliciously, just automatically. The attacker does not have to destroy the logs; the calendar does it for them.

A professional preservation step does several things at once, and does them before touching the account:

1. Export and hold the audit data. Pull the unified audit log, mailbox audit log, message trace, and sign-in logs into an independent, hashed, chain-of-custody-controlled store — out of the tenant, where remediation and further retention loss cannot reach it.
2. Snapshot current state. Capture the live inbox rules, forwarding configuration, delegate permissions, registered OAuth applications, MFA methods, and trusted devices as they exist right now, because remediation will change all of them within the hour.
3. Place a litigation or preservation hold. Where the matter may lead to insurance recovery, regulatory notice, or litigation, invoke platform retention holds so mailbox content cannot be purged.
4. Document the timeline of your own actions. Every responder action is logged so the investigation can later distinguish attacker activity from cleanup.

Only after evidence is secured does containment proceed. The order is not bureaucratic caution — it is the difference between a case you can prove and a story you can only assert. Organizations that preserve first routinely recover funds, satisfy insurers, and support prosecution; organizations that reset first often cannot even establish which account was breached.

How do you trace the intrusion from first access to full scope?

With evidence preserved, the investigation reconstructs the attacker’s entire tenure. This is disciplined correlation work — stitching sign-in records, mailbox activity, mail flow, and configuration changes into a single defensible timeline. A world-class BEC investigation follows a repeatable sequence:

1. Establish initial access. Identify the first anomalous sign-in — foreign IP, unfamiliar device, impossible-travel pattern, or a session that bypassed MFA — and fix the moment of compromise.
2. Map persistence. Enumerate every malicious inbox rule, forwarding address, delegate grant, OAuth application, and added MFA method, so nothing is left behind after containment.
3. Reconstruct attacker activity. Trace what was read, moved, deleted, forwarded, or sent from the account, and identify the fraudulent messages sent to vendors, clients, or colleagues.
4. Assess lateral movement. Determine whether the actor reached other mailboxes, SharePoint or Drive content, or connected systems — BEC frequently spreads through internal phishing from the trusted account.
5. Scope data exposure. Identify whether regulated, financial, or privileged information was accessible or exfiltrated, which drives notification obligations.
6. Quantify the fraud. Reconstruct the financial mechanism — altered banking details, redirected wires, fraudulent invoices — and the exact loss.
7. Confirm eradication. Verify every foothold is closed: tokens revoked, rules removed, sessions killed, credentials and MFA reset, rogue apps de-consented.
8. Produce the record. Deliver a defensible report with timeline, indicators, and methodology that withstands scrutiny from insurers, regulators, and courts.

The through-line is correlation. Any single log tells a fragment; the case is made by aligning them so that a specific sign-in from a specific address is tied to the creation of a specific rule and the sending of a specific fraudulent message. That is the standard our cyber services and forensic teams hold, because it is the standard that survives an adversarial challenge.

How do you recover, harden, and report after a BEC?

Eradication closes the intrusion; recovery restores trust and reduces future exposure. On the financial side, speed is everything: funds diverted by wire may be recoverable if the originating bank and the FBI are engaged within a narrow window, which is why a suspected fraudulent transfer should trigger both an immediate recall request to the bank and a complaint to IC3 without waiting for the investigation to finish. On the technical side, hardening addresses the conditions that allowed the compromise: enforcing phishing-resistant MFA, restricting or auditing third-party OAuth application consent, disabling external auto-forwarding, alerting on new inbox rules, and reviewing conditional-access and legacy-authentication settings that attackers exploit.

Reporting obligations depend on what the investigation finds. A pure payment-diversion fraud with no data exposure carries different duties than a compromise that exposed regulated personal, health, or financial information — where state breach-notification laws and sector regulations may compel disclosure within fixed timeframes. Guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and the reporting infrastructure at IC3 anchor the response, but the forensic record is what makes any report accurate rather than speculative. Under-reporting invites regulatory exposure; over-reporting on guesswork creates needless liability and alarm. Precision — the product of preserved evidence — is what protects the organization in both directions. When the matter touches contracts, insurance claims, or litigation, the same forensic foundation feeds the broader investigations and intelligence picture that establishes attribution and supports recovery.

How does Honeybadger investigate business email compromise?

Honeybadger Solutions investigates BEC the way it must be done to hold up — preservation first, correlation second, remediation guided by evidence rather than panic. Because our digital forensics, cybersecurity, financial-investigation, and background-intelligence capabilities are handled in-house and delivered nationwide and internationally, a compromise never fragments across disconnected vendors: the same command that preserves the audit logs and maps the OAuth grants also traces the redirected funds and builds the reporting record. We move fast against the retention clock, secure the cloud evidence before it expires, reconstruct the attacker’s full tenure across Microsoft 365 and Google Workspace, and confirm eradication of every foothold — hidden rules, rogue applications, and lingering tokens alike.

Our work supports the outcomes that follow an incident — insurance recovery, regulatory notification, vendor and client remediation, and where warranted, litigation and law-enforcement coordination — all under a single accountable chain of command. From Arizona home command, with offices in Casa Grande, Phoenix, and Oro Valley, we serve executives, general counsel, families, and organizations across the United States and abroad, closing the gap between what happened inside the mailbox and what can be proven and recovered afterward.

Frequently asked questions

Why isn’t resetting the password enough after a BEC?

Because password resets do not revoke everything the attacker set up. OAuth access and refresh tokens are independent of the password, so a granted malicious application keeps its access until the consent is explicitly revoked. Hidden forwarding rules, delegate permissions, and attacker-added MFA methods also survive a reset. Full eradication requires revoking tokens and sessions, removing rules and rogue apps, and resetting credentials and MFA — only after the evidence is preserved.

How quickly do email logs need to be preserved?

Immediately — ideally within days. Key sources age out on fixed schedules: Microsoft 365 sign-in detail may retain only about 30 days by default and audit logs around 90, while Gmail’s granular message log search runs about 30 days. Once a window closes, that evidence is gone. Preserving and exporting the logs to an independent, hashed store is the first professional action, before any password reset or cleanup.

Can a BEC bypass multi-factor authentication?

Yes. Adversary-in-the-middle phishing kits capture the authenticated session token rather than the password, inheriting an already-verified session and sidestepping MFA. Attackers may also add their own MFA method or trusted device to maintain access. This is why phishing-resistant MFA, session and token monitoring, and forensic review of sign-in tokens matter — a green MFA log is not proof the login was legitimate.

Can funds lost to a BEC wire fraud be recovered?

Sometimes, if you act fast. Recovery often depends on engaging the originating bank and the FBI within a narrow window after the transfer — filing a complaint with IC3 and requesting a recall can trigger the financial fraud kill chain that freezes funds before they are withdrawn. The odds fall sharply with each passing day, so a suspected fraudulent wire should prompt immediate bank and law-enforcement contact in parallel with the forensic investigation.