Remediation Steps for a Business Email Compromise Attack
A business email compromise (BEC) attack uses deception to make a legitimate payment, disclose sensitive information or change a trusted business process. The attacker may impersonate a chief executive, supplier, conveyancer or finance employee, often after taking control of a real mailbox. In Australia, the incident can affect accounts payable, payroll, customer data and relationships with banks within minutes.
The first priority is to slow the attack without destroying evidence. A rushed password reset from a compromised device, for example, may alert the intruder or leave a second session active. Effective remediation combines account containment, financial recovery, forensic investigation, legal assessment and improvements to email security.
Australian organisations also need to consider the Privacy Act 1988, the Notifiable Data Breaches scheme and guidance from the Australian Cyber Security Centre (ACSC). A BEC incident may involve personal information, employee records or tax details even when the apparent loss is a fraudulent invoice.
The response should therefore involve more than the IT team. Finance, senior management, legal counsel, human resources, communications, banking contacts and cyber insurance advisers may all have time-sensitive responsibilities. A coordinated process reduces further losses and creates a defensible record of decisions.
Recognise the Attack and Stabilise Operations
Common warning signs include an urgent request to alter supplier bank details, an unexpected demand for secrecy, a reply from an unusual address, a new mail-forwarding rule or a message that changes tone and writing style. Attackers frequently exploit familiar Australian payment habits, including direct deposit, BPAY, PayID and Osko, because staff are accustomed to processing transactions quickly.
Once suspicious activity is identified, establish an incident lead and create a secure communication channel outside the affected email environment. Use known telephone numbers from supplier records or official websites, rather than numbers in the suspicious message. Tell relevant staff to pause unusual payments, bank-detail changes, payroll amendments and requests for sensitive documents until they are independently verified.
Do not delete the fraudulent email or reset every account without a plan. Record the time the activity was detected, the people involved, the systems affected and any funds sent. If a mailbox is still accessible, capture relevant headers, message IDs and rule settings before making changes where practical. This initial timeline will guide containment and later discussions with the bank, insurer and regulators.
Contain Accounts and Mailboxes
An administrator should revoke active sessions and refresh tokens for compromised identities, then reset passwords using a trusted device. Require phishing-resistant multifactor authentication where available, such as hardware security keys or passkeys. Review the identity provider for unfamiliar devices, risky sign-ins, impossible travel alerts, legacy authentication and newly registered authentication methods.
Inspect the mailbox for hidden forwarding rules, deleted messages, inbox rules, delegated access, transport rules and suspicious OAuth applications. Attackers often create rules that move bank correspondence into an obscure folder or forward it to an external address. Remove unauthorised persistence, but export the relevant configuration and audit records first if the investigation requires them.
Containment should cover related identities, not just the first compromised account. Check executives, finance staff, procurement officers, shared mailboxes, service accounts and suppliers whose accounts may have been impersonated. Temporarily restrict external forwarding, risky attachment types and automatic mailbox permissions while the organisation confirms that legitimate workflows still operate.
Email monitoring can help identify unusual access, forwarding and communication patterns before they become a larger data loss event; organisations assessing this capability may find email monitoring controls useful when designing preventive controls.
Preserve Evidence and Determine the Scope
A BEC investigation should establish how the attacker gained access, which messages were read or sent, what data was exposed and whether other systems were reached. Collect identity-provider logs, Microsoft 365 or Google Workspace audit records, endpoint telemetry, secure email gateway alerts, DNS information and relevant financial-system logs. Preserve original messages in a format that retains headers and timestamps.
Build a simple event timeline using Australian Eastern Standard Time or Australian Eastern Daylight Time, while retaining the original system time zone. This matters when staff, banks or managed security providers work across Sydney, Melbourne, Brisbane, Perth or overseas locations. Record the first suspicious login, mailbox changes, messages sent, payment approvals and bank notifications.
Scope the incident broadly enough to capture business email impersonation outside the organisation. Search for lookalike domains, altered supplier details, similar invoices, unusual replies and messages sent to customers or partners. Review whether tax file numbers, identity documents, health information, employee payroll records or commercial contracts were accessed.
Evidence should be stored in a restricted repository with an audit trail. Limit internal discussion to people who need to know, since attackers may still monitor mailboxes or collaboration platforms. A specialist incident response provider can assist with forensic collection when the organisation lacks reliable logs or when litigation, regulatory review or insurance requirements are likely.
Prioritise Financial Recovery and Business Risk
Contact the bank’s fraud team immediately through an established channel. Ask whether the transaction can be recalled, frozen or traced, and provide payment references, beneficiary details, timestamps and evidence of impersonation. For Australian transfers, the bank may coordinate with the receiving institution, but recovery becomes harder as funds move through multiple accounts or overseas services.
Notify the affected supplier or customer using independently verified contact information. Explain which messages were fraudulent, what information may have been exposed and which account details must be disregarded. Finance should reconcile recent and scheduled payments, including recurring direct debits, payroll files, trust accounts and invoices awaiting approval.
| Response area | Immediate action | Evidence or outcome |
|---|---|---|
| Compromised mailbox | Revoke sessions, reset credentials and remove malicious rules | Sign-in records, rule history and access timeline |
| Suspected payment fraud | Contact the bank and request recall or transaction tracing | Case number, payment references and recovery status |
| Exposed personal information | Confirm data types, affected people and likely harm | Privacy assessment and notification decision |
| Supplier impersonation | Verify details through a trusted channel and warn contacts | Confirmed account information and communication record |
| Executive or finance identity | Apply stronger authentication and review delegation | Clean authentication methods and access review |
| Wider compromise | Search related mailboxes, domains, endpoints and applications | Scope report and containment evidence |
The incident lead should rank actions by probable harm and time sensitivity. A fraudulent transfer demands immediate banking action, while a suspected disclosure of employee identity data may require privacy analysis and support for affected people. Keep a decision log explaining why particular systems were isolated, notifications delayed or restoration steps approved.
Cyber insurance can introduce notification deadlines, panel-provider requirements and consent rules for costs. Before engaging an unfamiliar vendor, review the policy and insurer instructions; CARM’s discussion of cybercrime insurance guidance provides relevant context for connecting incident response, coverage and recovery planning.
Remove Persistence and Restore Trusted Access
After initial containment, search for persistence across the cloud tenant and endpoints. Review inbox rules, forwarding, delegated permissions, OAuth grants, application registrations, conditional-access exclusions, endpoint remote tools and newly created local accounts. Check whether the attacker modified supplier records, payment templates, bank details or approval workflows outside the email platform.
Rebuild trust in affected devices rather than assuming a password change solved the problem. Run endpoint investigations, apply security updates and reimage systems where credential theft or malware cannot be ruled out. Rotate privileged credentials, API keys, shared secrets and application passwords that may have been visible in email or browser sessions.
Restore services in stages. Start with identity, email and financial controls, then return normal external forwarding and business automation only after monitoring is in place. Validate mailbox access, approved delegates, transport rules and multifactor authentication with the system owner. Maintain heightened monitoring for several weeks because attackers may attempt re-entry after the visible compromise ends.
Meet Australian Reporting and Governance Duties
The organisation should assess whether personal information was accessed or likely accessed in a way that could cause serious harm. Under Australia’s Notifiable Data Breaches scheme, eligible breaches generally require notification to the Office of the Australian Information Commissioner and affected individuals. The assessment should be documented, and legal advice is appropriate where facts remain uncertain.
The ACSC can provide operational guidance, while businesses in regulated sectors may have additional expectations. APRA-regulated entities should consider obligations relating to information security, operational risk, incident reporting and business continuity, including the relevance of CPS 234 and CPS 230. Critical infrastructure operators may also have obligations under the Security of Critical Infrastructure Act.
Notify police or ReportCyber when appropriate, particularly where there is significant financial loss, identity crime or a broader criminal pattern. Scamwatch reporting can help Australian authorities identify scams, although it does not replace bank notification or regulatory assessment. Listed companies, professional firms and organisations handling government information may also need tailored advice about disclosure and contractual duties.
Communications should be factual and coordinated. Staff need clear instructions about what to say to customers and suppliers, while affected individuals may need practical advice about password changes, suspicious messages and identity monitoring. Avoid assigning blame; BEC succeeds by exploiting normal trust and realistic business pressure.
Strengthen Controls Against Repeat Compromise
Use layered payment verification rather than relying on email authentication alone. Any request to change bank details should require a callback to a previously verified number and approval by a second person. Separate the person who creates a supplier record from the person who approves payment, and require extra checks for urgent, unusual or high-value transactions.
Deploy DMARC, DKIM and SPF with a staged path towards enforcement, while monitoring lookalike domains and display-name impersonation. Configure conditional access, phishing-resistant MFA, risk-based sign-in controls and alerts for mailbox-rule changes. Disable legacy authentication and reduce standing administrative privileges. Email security tools should complement, rather than replace, staff judgement and process controls.
Training should reflect local working conditions. A finance employee in Brisbane may receive an urgent request from a Melbourne executive during a busy end-of-quarter period, while a Perth team may coordinate with east-coast offices across time zones. Exercises should include realistic supplier invoices, payroll changes, public holidays and remote work, with a clear rule that urgency never overrides independent verification.
Measure whether controls work in practice. Track time to detect, time to contain, payment recall time, MFA coverage, privileged-account reviews, external forwarding events and completion of supplier verification. Conduct tabletop exercises with the bank, insurer, legal advisers and managed security provider, then update contact lists and playbooks after each exercise.
Turn Incident Lessons Into Operational Resilience
A post-incident review should examine technology, procedures and decision-making without reducing the event to an individual mistake. Identify where the attacker obtained credibility, why a request bypassed approval, which logs were unavailable and how quickly the bank or supplier was contacted. Assign owners and deadlines for every corrective action.
Update the incident response plan with exact escalation paths, out-of-band verification methods, evidence-preservation steps and notification criteria. Store emergency contacts outside the corporate tenant, including bank fraud lines, the insurer’s incident number, legal counsel, the ACSC and key technology providers. Test that those contacts remain current.
The strongest long-term defence links identity security to financial governance. A well-protected mailbox can still support fraud if one employee can alter supplier records and approve a payment without independent review. Likewise, a careful finance process can be undermined when an attacker controls an executive’s real account and reads ongoing conversations.
A practical takeaway is to treat every suspicious payment request as a combined identity, financial and privacy incident: pause the transaction, verify through a trusted channel, contain the account, preserve evidence, notify the right parties and restore normal operations only after access and approval controls have been proven clean.