High severityHARDEC8 steps · 6 phases
Business Email Compromise (BEC) Response
Business Email Compromise (BEC) incident response; according to FBI IC3, $2.9 billion in losses in 2023. Covers account takeover, wire fraud, and OAuth abuse scenarios.
Information note
Informational note: In a business email compromise (BEC) response, immediately disable automatic forwarding rules and review mailbox delegation changes in Exchange/Microsoft 365 audit logs. In these phishing-initiated attacks, OAuth token persistence is often overlooked; unauthorized third-party application permission assignments must also be revoked. Adding an out-of-band approval step to financial transaction verification processes should be considered a post-response measure.
1
Preparation
1 steps- Establish BEC prevention/detection baseline
DMARC/DKIM/SPF (p=reject), impersonation detection, lookalike domain blocking, alert when a forwarding rule to an external address is created, finance/HR/executive training.
2
Identification
1 steps- Detect and classify the BEC incident
Unexpected forwarding/inbox rules, login from new geography/device, large wire request via email, CEO/CFO impersonation.
3
Containment
2 steps- Isolate the compromised email account
Revoke all active sessions/tokens, reset password, remove malicious forwarding rules and OAuth permissions, enable MFA.
- Stop the fraudulent wire transfer
If a wire has been initiated, call the sending bank IMMEDIATELY (24–48 hour critical window). Report to FBI IC3 Financial Fraud Kill Chain.