Business Email Compromise
Investigating Compromised Email Accounts, Suspicious Communications and Unauthorised Activity.
Business Email Compromise.
Business Email Compromise (BEC) can involve compromised email accounts, fraudulent communications, unauthorised access and attempts to influence financial or business activity.
Investigating a suspected incident may require examination of email trails, account activity, devices, authentication records and related digital evidence.
Key Incident Indicators
Unexpected changes to vendor or beneficiary bank account details
Unusual payment instructions received through email
Suspicious email forwarding rules or mailbox configuration changes
Unrecognised login activity involving corporate email accounts
Impersonation of executives, vendors or business partners
Unexpected password reset or multi-factor authentication activity
Emails sent from legitimate accounts without the account owner's knowledge
Unusual communication patterns involving finance, procurement or payment approvals
Requests to bypass established financial authorisation procedures
Key Challenges & Stellar Forensic Interventions
Identifying How the Email Account Was Compromised
A compromised business email account may provide an attacker with access to sensitive communications, contacts, documents and business processes. Understanding how the compromise may have occurred is an important part of the investigation.
Investigating Suspicious Email Activity
Unauthorised access may result in unusual login activity, unexpected messages, forwarding rules, changes to account settings or communications that differ from normal business activity.
Determining Which Communications Were Affected
A compromised account may contain sensitive business correspondence, attachments, customer information, financial information or other confidential material.
Investigating Fraudulent or Unauthorised Transactions
Business Email Compromise may be associated with fraudulent payment instructions, changes to banking details, impersonation or other attempts to influence financial activity.
Establishing the Scope and Timeline of the Incident
A BEC investigation may need to establish when the compromise began, what activity followed and whether related activity occurred across other accounts, devices or systems.
Understanding Whether Sensitive Information Was Accessed or Transferred
An attacker with access to a business email account may potentially access or transfer information contained in communications and attachments.