Incident response
Business Email Compromise
Quick answer
When a business mailbox may be compromised, protect the account and payment workflows first. Investigation comes after containment and evidence preservation.
Who this is for: Businesses seeing unusual forwarding rules, payment instructions, sign-ins, or impersonation.
What to do
- 01Secure the mailbox and revoke active sessions.
- 02Check forwarding rules, delegated access, app passwords, and recent sign-ins.
- 03Contact banks or payment providers through trusted channels if money may be at risk.
- 04Preserve messages and logs, then assess notification and legal obligations.
What this does not cover
Payment fraud and data exposure can create urgent legal and financial consequences; involve the relevant providers and qualified professionals.
This page is educational information, not legal advice or a professional security audit. Check the official requirements and get qualified help when your circumstances require it.
Continue exploring