Business email hacked, what to do about the wire

Someone used a work mailbox, or an address that looks like yours, to send a payment the company did not mean to make. Call the bank that sent the money, on a number you already had, and ask them to recall it. Then lock the mailbox. A new password does not pull the wire back. Check forwarding after you change it. Google and Microsoft both list that check as its own step.

The FBI Internet Crime Complaint Center’s BEC page says to contact the originating financial institution as soon as you recognise the fraud. Ask for a recall or a reversal, and for a hold harmless letter or a letter of indemnity. IC3 says getting those requests in quickly may reduce the loss, or clear it. In the United States, file a complaint at ic3.gov with the banking details the form asks for. Do that whatever the amount. IC3’s September 2024 alert says banks do not all offer the same help, and that IC3 may be able to work with the banks and with law enforcement on a freeze.

If the company is outside the United States, ic3.gov is the FBI’s form. Make the bank call anyway. In the UK, the NCSC’s payment-fraud page says to tell the person who runs your IT, and to call the bank on its official site or phone number. The report link for a UK organisation is on that page. Anywhere else, call the bank, then the fraud office your bank or your government names. We do not have one refund deadline that fits every country.

Say whether someone at the company approved the transfer because the email looked real. Banks treat that differently from a payment nobody at the company sent. The country-by-country shape of that call is Scammed or fraudulent bank charge. The mailbox checklist is Business email compromised.

Read the address before you reset anything

Two different tricks end at the same bank. In one, someone is inside a real mailbox. In the other, the message came from an address one letter off, and your mailbox was never opened.

IC3’s BEC page tells you to read the sender’s address, especially on a phone, and to make sure the computer shows the full address. A display name can say your supplier while the address is a lookalike. CISA’s BEC alert describes the same split. Attackers use the real account, or a spoofed one. The alert dates from 2015, and it is still the page CISA publishes for this.

If the address is fake, the urgent job is the bank call and a phone call to the real supplier, on a number from your own records. You still check the real mailbox. These incidents often start with a lookalike and continue once someone is inside.

Signs the real mailbox was used, from Microsoft’s compromised-account guide:

• Mail is missing, or the mailbox is blocked from sending.
• A rule forwards mail to an address you do not know, or files it into Notes, Junk Email, or RSS Subscriptions.
• Sent or Deleted holds messages you did not write. Microsoft’s example is “I’m stuck in London, send money.”
• The person’s name, telephone number, or postal code changed in the Global Address List.
• The password changed, or the account locked, more than once, and nobody on the team did it.
• External forwarding was added.
• The signature changed. Microsoft’s examples are a fake banking signature and a prescription-drug signature.

On Google, a banner that mail is forwarding, when nobody set that up, is the same kind of sign. Google’s forwarding article says to change the password and turn forwarding off.

A single verification code you did not request is a weaker sign. Google’s admin sign-in article says an unrequested code does not, by itself, mean the account was taken. Delete it. Do not read it to a caller. If the codes keep coming, or a payment moved, continue below.

Copy the sent messages, the amounts, the account numbers, and the times before you delete anything. IC3 wants those banking fields in the complaint. Write down any forwarding address before you remove the rule. That address is who was reading the mail.

Use an admin login that is still yours, on a computer that did not open the suspicious message. If the only admin account is the one that was taken, use the recovery section for that system further down.

If the mailbox is Google Workspace

Google’s compromised-account checklist starts by suspending the user. You need an administrator account with the user-management privilege.

1. In the Admin console, go to Menu, then Directory, then Users.
2. Point to the user and click More options, then Suspend user. On the user’s account page, Suspend user is on the left.
3. Click Suspend.

Google’s suspend article says new email and calendar invitations are blocked. Mail, files, and calendars are not deleted. People the user already shared documents with can still open those documents. A suspended account is still billed. The compromised-account checklist says this suspension resets the user’s sign-in cookies and OAuth tokens.

The user cannot open Gmail while the account is suspended. Investigate from the admin tools on that same checklist. If the user is an administrator, read the Admin audit logs. User log events list successful and failed web sign-ins for up to 6 months, and they flag suspicious ones. Email log search shows mail to and from the account. If the domain has Vault, that search can also review email activity. In the security report, review OAuth log events, groups log events, and Drive log events.

Then reset the password. Google’s reset article requires an admin who is allowed to reset passwords. Resetting another administrator takes a super admin.

1. Go to Menu, then Directory, then Users.
2. Point to the user and click Reset password, or open the account page and use Reset password on the left.
3. Choose Automatically generate a password. Google gives that as the example for a compromised account. At the next sign-in, the user is asked to change it.
4. Click Reset, then Copy password. Read it to them by phone, or send it to a different inbox they can open. New mail to the suspended mailbox is blocked.
5. Open the account page, then Security, then Sign in cookies, then Reset.

Google says that after the password reset and the cookie reset, the user is signed out of active sessions. Gmail on the web needs the new password. On Android they have to verify. On iPhone and iPad, Google removes the account from the account list, and it has to be added again. Mail apps that connect with OAuth stop syncing until the user signs in and gets a new token. Application-specific passwords are revoked. Create a new one only if an old app still needs it. The checklist also tells you to remove app passwords the user created.

The user cannot open Gmail while the account stays suspended, so the forwarding check comes after you restore it. Google’s restore article says to open the Users list, click More options, then Reactivate, and confirm with Reactivate. The account page has Reactivate as well. Ask the user to set a password they have never used on another site. Turn on 2-step verification. Google recommends a security key over a code.

Then sit with them, on a computer you trust, and open Gmail. Google’s Gmail security tips use Settings, then See all settings.

• On General, read the signature and the vacation responder. Turn the responder off if the text is not yours.
• On Accounts and Import, read Send mail as, Grant access to your account, and Check mail from other accounts. Remove any address or person you do not know.
• On Filters and Blocked Addresses, find filters that say Forward to or Delete it. Delete the ones you did not create. Write the destination down first.
• On Forwarding and POP/IMAP, if forwarding points at an address you do not know, click Disable forwarding, then Save Changes. Check that POP and IMAP are what you expect.

If you cannot get into the Admin console

Use Google’s admin recovery page. Go to accounts.google.com/signin/recovery and enter the admin address.

If a recovery email or phone is on the account, Google sends a code. If it is not, the wizard asks you to add a CNAME record at the domain host. Wait a few minutes, then click Next. If Google finds the record, you set a new password. If it does not, give a contact address that is not the locked mailbox. Google says that if the CNAME is still missing after 48 hours, they email you that recovery failed.

Another super admin can reset your password from the Admin console. If a reseller sold you the service, Google points you to that reseller. Support-assisted recovery comes after the automated flow. You prove you control the domain with a CNAME or TXT record. Google says that DNS change can take up to 24 hours. The contact address you give them must not be the locked mailbox.

If 2-step verification is what blocks the only admin, Google’s sign-in article sends you to that same recovery. A second admin with access to security settings can restore the first without opening a support case.

If the mailbox is Microsoft 365

A personal Outlook.com, Hotmail, or Live login is a different system. The work steps below are for a mailbox your company administers. The personal path is Outlook or Hotmail account hacked, what to do.

Microsoft’s compromised-account guide says to disable the account until you have finished looking. If you cannot disable it, reset the password. Do not email that password. Do not reuse any of the last five passwords.

In the Microsoft 365 admin center, you need a role that can reset passwords.

1. Open Users, then Active users.
2. Select the person, then Reset password.
3. Generate a password or type one, then select Reset password.
4. Print the details to a PDF and store that file. Share it by phone or by a different inbox. Microsoft says that as of 30 August 2024 the admin center no longer emails those passwords.

Then sign the sessions out. Microsoft’s block-sign-in article says to select the user again, open the Account tab, and select Sign out of all sessions. An access token can keep working for up to an hour. Block sign-in, on that same page, can take up to 24 hours, so the password reset is what stops a fresh sign-in sooner. The compromised-account guide still prefers the account disabled while you investigate. The command it shows is Update-MgUser with AccountEnabled set to false. Use that if you already manage users in Microsoft Graph. The admin center block is the click version, with the delay above.

A password reset does not delete app passwords. Microsoft says the person should delete the old ones and create new ones only if a device still needs them.

If the account is synced from on-premises Active Directory, reset the password there, twice. Microsoft says the two resets cut the risk of a pass-the-hash attack. If sign-in is federated, change the password in the on-premises system and tell that administrator.

Stay on the compromised-account guide for the rest of the cleanup.

• Remove multifactor methods you do not recognise.
• Remove apps the user consented to that should not be there.
• Remove admin roles that person should not have.

Forwarding and hidden rules need Exchange Online PowerShell. Connect the way the guide describes, then run these two commands with the real address.

Get-Mailbox -Identity [email protected] | Format-List Forwarding*Address,DeliverTo*
Get-InboxRule -Mailbox [email protected] -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity

ForwardingAddress is someone inside your tenant. ForwardingSmtpAddress is an outside address. If both are set, mail goes only to the internal address. DeliverToMailboxAndForward set to true means the mailbox keeps a copy and also forwards it. Set to false, the mailbox does not keep a copy. On a rule, RedirectTo sends the message on and does not deliver it to this mailbox. ForwardTo forwards it. ForwardAsAttachmentTo sends it as an attachment. Write those addresses down, then remove the rules you did not create.

The visible list in Outlook on the web is Settings, then Mail, then Rules. Microsoft’s rules article puts Delete there. Hidden rules show up in the PowerShell command, not in that list, which is why the compromised-account guide uses -IncludeHidden.

Read Sent and Deleted in Outlook on the web once you can sign in as that user. For the admin view of what left the tenant, the guide points at message trace in the Microsoft Defender portal. In the Microsoft Entra admin center, read the sign-in logs for IP address, place, time, and success or failure. Start just before the suspicious activity and go through the cleanup. On the first pass, do not filter the audit log down to one activity.

If the mailbox was blocked from sending because it pushed out a lot of mail, the guide says to remove the user from the Restricted entities page after the investigation. When you disabled the account, reset the password and turn the account back on only after the rules and the forwarding addresses are yours again. Turn multifactor authentication on. Microsoft says it matters most on admin accounts, and the guide points at phishing-resistant multifactor authentication for those admins.

If you cannot sign in and there is no other admin, Microsoft’s password article says to call Microsoft Support. That page does not print a phone number. Start from a Microsoft page you typed yourself.

Call the people named in the sent mail

Do this by phone, on a number from a contract, an old invoice, or a call you have already made. Do not use the number in the email signature, and do not send the warning from the mailbox you are fixing.

Microsoft’s compromised-account guide says not to email the new password, because the other person may still be reading. A warning sent the same way has the same problem. IC3 says to verify a change of account details on a second channel. CISA’s alert is more specific about suppliers. Call a number from a contact list you already keep, not from the message that announced the new bank account.

Tell them the new details are not yours. If they already paid, they call their own bank. IC3 says the recall request goes to the bank that sent the money, which in their case is their bank.

IC3’s 2024 alert says some of these thefts also ask for employee personal data, so other accounts can be taken next. After forwarding is off, change the password on the bank, payroll, the domain registrar, the cloud account, and the password manager. Do that from a computer you trust. Those services mail their resets to this inbox. If forwarding is still on, the reset leaves with them.

What to change before the next invoice

Keep the timeline, the amounts, the account numbers, and the complaint reference. In the United States that reference is the IC3 filing, with the banking fields filled in.

CISA’s alert is the payment side of the fix. Keep vendor phone numbers in a file outside the mailbox. CISA prefers a copy that is not electronic. Limit who can approve or send a wire. Require a second approval for a new supplier, a new account number, an amount over the line you set, or a country you do not usually pay. If the bank rings to confirm a wire, wait and check before you tell them to release it. Verify an executive’s wire request by calling them, with a phone PIN you agreed in advance, or by texting a one-time code and a number to call. Use a number from your own records.

On the mailbox side, have two administrators on separate accounts. Google recommends security keys for 2-step verification. Microsoft points admins at phishing-resistant multifactor authentication. A second admin should be able to suspend a user, reset sessions, and find a forwarding rule without the first admin’s phone.

The next page is the mailbox checklist, starting at the first minutes: Business email compromised. If the money has already moved, keep the bank’s case number with you and use Scammed or fraudulent bank charge for the questions they will ask.

Related playbooks

• Business email compromised. An attacker may read mail, reset other accounts, impersonate the business, or redirect payments.
• Scammed or fraudulent bank charge. Money left your account that you did not authorise, or you were talked into sending it and have just realised.