#14.2 Business Email Compromise and Payment Fraud

Playbook ID: PB-BEC | Default severity: SEV-3 (SEV-2 once funds have left or a second mailbox is implicated; SEV-1 and switch to Playbook 14.4 if the account holds a privileged directory role) | Owner: Incident Commander

#When to run this

Open this playbook on: a payment sent to an account that does not belong to the payee; a supplier or customer reporting a hijacked email thread; Unified Audit Log returning New-InboxRule or Set-InboxRule with DeleteMessage set, or a move to a folder nobody reads (RSS Subscriptions, Conversation History); an external ForwardingSmtpAddress nobody requested; an Entra ID Protection high-risk detection on an account with payment authority; MailItemsAccessed records carrying an unexpected ClientAppId/AppId or a SessionID that is not the user's; or anyone in finance taking a call from an "executive" pressing for a payment change.

Not for: encryption with an extortion demand (14.1); identity-provider compromise (14.4); SaaS takeover where mail is not the objective (14.3); synthetic-media approaches that never reached a mailbox (14.9). Finance's own callback script and vendor-master change control are Chapter 19.

#What you are dealing with

The mailbox is not the target. The payment instruction is. An attacker who owns a finance mailbox drops no malware and defaces nothing — they read the invoice threads, learn your approval language, learn which supplier invoices on the 30th, then send one email changing one set of bank details. IC3 recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025 (IC3 2025).

Two clocks start together and run at wildly different speeds. The money clock is hours: IC3's Recovery Asset Team ran 3,900 Financial Fraud Kill Chain incidents in 2025 against $1.16bn of attempted theft and froze $679,013,183 — a 58% success rate, down from 66% (IC3 2025; IC3 2024). Six chances in ten, decaying hourly. The forensic clock runs in days. Teams that run these two in sequence lose the money and then produce a beautiful timeline explaining how.

The access is rarely exotic. Adversary-in-the-middle kits proxy the real sign-in page and capture the session token after genuine MFA completes — MFA is not bypassed, it is made irrelevant (Group-IB; Proofpoint). The other live path is consent: IC3's September 2026 PSA describes an active campaign where victims approve a malicious app on a genuine Microsoft or Google consent screen, granting persistent read-and-send access without the password — and a password change does not revoke it (Help Net Security on IC3 PSA260901). At the top end the pressure is synthetic: Arup lost about US$25.6m across 15 transfers in one day after an employee's scepticism was defeated by a video call in which every other participant was AI-generated (CNN).

So the mistake teams make is the comfortable one: reset the password, close the ticket. Microsoft says it in writing — "normal remediation steps (for example, resetting passwords or requiring multifactor authentication (MFA)) aren't effective against this type of attack, because these apps are external to the organization" (illicit consent grants). A reset leaves refresh tokens, an OAuth grant, an inbox rule and a forwarding address behind, and tells the adversary you noticed. Takeaway: containment here is revoke, remove, reset — one action, that order.

#Roles for this incident

#Phase 1 — Detection and Triage

The first ten minutes answer two questions: has money moved, and who else can read this mailbox right now.

# Two modules, two connections. The mailbox cmdlets are ExchangeOnlineManagement; the risk
# cmdlets further down are Microsoft Graph. Neither session gets you the other.
Connect-ExchangeOnline

# Capture before you change anything. Forwarding set via Set-Mailbox does NOT appear
# in Get-InboxRule output — you must read the two properties separately.
Get-InboxRule -Mailbox <mbx> | FL Name,Description,DeleteMessage,MoveToFolder,Enabled
Get-Mailbox    <mbx> | FL ForwardingAddress,ForwardingSmtpAddress

# Who created or changed mailbox rules, and when. Microsoft names exactly three operations.
# Without -SessionCommand this cmdlet returns at most 100 records however high you set
# -ResultSize — and a truncated set is how you undercount mailboxes and miss the SEV-1 line.
# ReturnLargeSet comes back unsorted; re-run it with the SAME -SessionId until it returns
# zero rows, then sort what you have.
Search-UnifiedAuditLog -StartDate <MM/DD/YYYY> -EndDate <MM/DD/YYYY> -UserIds <user1,user2> `
  -Operations New-InboxRule,Set-InboxRule,Remove-InboxRule `
  -SessionCommand ReturnLargeSet -SessionId <id> -ResultSize 1000

# Risk state — a different module and a separate connection from everything above.
# Requires Security Administrator plus the scopes below.
Connect-MgGraph -Scopes "IdentityRiskEvent.Read.All","IdentityRiskyUser.ReadWrite.All"
Get-MgRiskyUser -Filter "RiskLevel eq 'high'"
Get-MgRiskDetection | Format-Table UserDisplayName,RiskType,RiskLevel,DetectedDateTime

# Empty because mailbox auditing was never on? Enable it for the NEXT incident —
# audit events cannot be obtained retroactively.
Set-Mailbox <mbx> -AuditEnabled $true -AuditOwner @{Add="Create","Update"}

Identify who modified mailbox rules · ID Protection via Graph

#Phase 2 — Containment

Two tracks, same clock, different owners. The Incident Commander's job is to stop anyone turning them into a queue.

#Phase 2A — The money track

IC3's own words: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents. Different financial institutions have varying policies; it is important to know what assistance your financial institution will provide" (IC3 2025).

#Phase 2B — The identity track

# Microsoft's documented emergency revocation. Revoke-MgUserSignInSession invalidates
# refresh tokens and browser session cookies via signInSessionsValidFromDateTime.
# Admin-role accounts require Privileged Authentication Administrator.
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
$User = Get-MgUser -Search UserPrincipalName:'<upn>' -ConsistencyLevel eventual
Revoke-MgUserSignInSession -UserId $User.Id
Update-MgUser -UserId $User.Id -AccountEnabled:$false     # only if you decided to disable

Hybrid identity: do the on-premises side first and reset the AD password twice — Microsoft's stated reason is to mitigate pass-the-hash where replication is delayed (Revoke user access). Google Workspace needs both users/{userKey}/signOut (POST) and users/{userKey}/tokens/{clientId} (DELETE) on admin.googleapis.com, because signing the user out does not revoke a third-party OAuth grant (signOut · tokens.delete).

#Phase 3 — Eradication

# CISA's shape for the two events that stay OFF until you enable them.
# Adding an action REPLACES the default set for that sign-in type — always re-verify.
Set-Mailbox <identity> -<sign-in type> @{Add="SearchQueryInitiated"}
Get-Mailbox <identity> | FL *Audit*

# Tenant-wide OAuth consent inventory (Microsoft's documented method).
.\Get-AzureADPSPermissions.ps1 | Export-csv -Path "Permissions.csv" -NoTypeInformation

CISA Expanded Cloud Logs Playbook · illicit consent grants

Blocklisting the phishing domain is worth doing and worth almost nothing: AiTM infrastructure rotates on a 24-to-72-hour domain lifetime by design (Group-IB). Takeaway: the client IP, user agent and SessionID belong in the hunt query at step 3.4, not just the block list.

#Phase 4 — Recovery

Phishing-resistant MFA blocks over 99% of identity-based attacks even when the attacker already holds a valid username and password (MDDR 2025), and CISA is explicit that number matching is a push-fatigue mitigation, not the destination (CISA). Actionable takeaway: if you can fund one cohort this quarter, fund the people who can move money — and set the date before you close this incident.

#Phase 5 — Post-Incident

#Decision points

#Communications and notification triggers

In BEC the regulatory clock is almost never started by the money. It is started by what was in the mailbox. A finance mailbox holds employee bank details and customer data; an HR or clinical mailbox holds special-category or protected health information. If step 3.1 shows personal data was accessed, GDPR Article 33's 72 hours from awareness is running, and the Scribe's timeline is your only evidence of when awareness arose. US state statutes, HIPAA and sector rules run in parallel on the same facts; the full matrix is Chapter 15.

Three items belong here rather than there. File the IC3 complaint regardless of loss amount — it is the entry point to the Recovery Asset Team, not a regulatory notification. Notify the cyber insurer early; social-engineering-fraud cover is commonly conditioned on prompt notice. And if the loss could be material to a public filer, the Executive Sponsor opens the materiality assessment on day one.

#Automation notes

Automate the collection, never the eviction. Steps 1.5 through 1.7 should fire the moment a BEC alert opens: export the sign-in logs, dump the inbox rules, read both forwarding properties, pull the rule-change records, list the OAuth grants, attach it all to the ticket. Read-only, reversible, and twenty minutes ahead of a human at a console — which matters when Entra Free retains seven days.

Gate everything else. Session revocation, credential reset, rule removal, consent revocation and account disable all tip off the adversary or destroy telemetry, and their blast radius scales with a false positive. The rule that holds up: automation may gather, enrich, correlate and recommend without approval; it may act only where the action is reversible, scoped and rate-limited; irreversible or tenant-wide actions require a named human approver. Every automated closure must carry the evidence that justified it — the documented failure modes for AI agents in triage are overconfident closure on weak proof and hallucinated detail in the narrative, and a rule change that looks benign is exactly where both bite. The money track is not automatable at all: no machine phones a bank fraud desk.

#Pitfalls