How do we prevent business email compromise in Microsoft 365?

Key facts

• Most BEC starts with a stolen session or password, not malware.
• Adversary-in-the-middle phishing can steal sessions even when basic MFA is on.
• Malicious inbox rules and forwarding are the classic signs of a compromised mailbox.
• DMARC at quarantine or reject stops attackers spoofing your exact domain.
• An out-of-band call-back on payment changes stops fraud even when email controls fail.

How BEC attacks usually work

Business email compromise is fraud carried out through email. Attackers either take over a real mailbox or impersonate one, then use it to redirect payments, change payroll details or request gift cards or sensitive data.

A common pattern today is adversary-in-the-middle phishing. The user clicks a link to a fake sign-in page that relays to Microsoft, completes MFA, and the attacker captures the session token. The attacker then signs in, creates inbox rules to hide replies, reads threads about invoices and sends a convincing payment change request from the real account.

Make accounts hard to take over

Identity controls stop most BEC before it starts. Push toward methods that cannot be relayed by a fake site.

• Require MFA for all users with Conditional Access, and move toward passkeys, FIDO2 keys or Windows Hello for Business.
• Require phishing-resistant authentication strengths for admins and finance staff first.
• Block legacy authentication so passwords alone cannot be used.
• Require compliant or managed devices for mail access where practical; stolen tokens are less useful from unmanaged devices.
• With Entra ID P2, use sign-in and user risk policies to challenge or block risky sessions.
• Restrict user consent to third-party apps to stop consent phishing that grants mailbox access.

Make impersonation and spoofing hard

Defender for Office 365 anti-phishing policies can protect named users such as executives and finance staff from lookalike sender names, and protect your own and key partner domains from lookalike domains. Apply the Standard or Strict preset security policies and add protected users and domains.

Configure SPF, DKIM and DMARC for every domain you own, including parked domains, and move DMARC from monitoring to quarantine or reject once legitimate senders are aligned. Turn on external sender tagging in Outlook so users can see when mail comes from outside, even when the display name looks familiar.

Detect a compromise early

Assume some attacks will get through and make them visible fast.

Make fraud hard to complete

Technical controls reduce risk but cannot remove it. Business process closes the gap. Require out-of-band verification, using a phone number already on file, for any new payee or change to bank details. Use dual approval for payments above a threshold. Tell vendors how you will and will not communicate payment changes.

Train finance, HR and executive assistants specifically, since they are the most targeted. Make reporting easy with the built-in Report button in Outlook, and thank people who report, even when it turns out to be legitimate.

If a mailbox is compromised

Act quickly. Revoke the user's sessions in Entra ID, reset the password and review MFA methods. Remove malicious inbox rules, forwarding and any app consents. Search the audit log for what the attacker accessed and sent. Alert contacts who may have received fraudulent mail, contact your bank if money moved, and notify your insurer and legal counsel as your policies require.

How Accred Consulting approaches it

Accred Consulting tackles BEC across identity, email and process. Discovery reviews sign-in methods, Conditional Access, Defender policies, DMARC status, forwarding and inbox rule alerts. The proposal sets a clear scope, fixed price and timeline. US-based specialists roll out phishing-resistant MFA starting with admins and finance, tune Defender impersonation protection, move DMARC to enforcement, block external auto-forwarding and set up alerting, with structured check-ins. A roughly 350-user manufacturer reached MFA and Conditional Access in 6 weeks this way. Handover includes a compromise response runbook and knowledge transfer, with optional support retainers.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions