Checking for a hacked mailbox: how to tell whether business email is compromised

Signs of a compromised business mailbox, what to check in Microsoft 365 and Google Workspace, and the first steps to regain control.

OfSec 2 min read

A compromised business mailbox is the entry point for many invoice fraud cases. The attacker reads the correspondence for weeks and, at the right moment, sends a customer a message about a “new bank account”. The signs need to be checked in time, before a customer transfers money to the wrong account.

Signs of a compromised account

  • the Sent folder contains messages you did not send;
  • contacts report unusual emails from your address;
  • you receive sign-in alerts from an unknown location or device;
  • the mailbox has rules that forward or delete messages;
  • the password has been changed or an unknown recovery phone number has been added.

Checks in Microsoft 365

  • the sign-in logs in Microsoft Entra, for sign-ins from unknown countries and IP addresses;
  • inbox rules and forwarding settings in Outlook;
  • applications with access to the account (Enterprise applications), for unknown permissions;
  • the user's multi-factor authentication methods.

Checks in Google Workspace and Gmail

  • active sessions, through the “Details” link at the bottom of Gmail;
  • filters and forwarding in the Gmail settings;
  • third-party applications with access to the account;
  • the audit logs in the Workspace admin console.

Leaked passwords

Check whether your business addresses appear in known data breaches using Have I Been Pwned (haveibeenpwned.com). If an address is listed and the password has not been changed since, assume it is compromised.

If the account is compromised

  1. From another, secure device, change the password and end all active sessions.
  2. Enable or reset multi-factor authentication.
  3. Delete unknown forwarding rules and applications with access.
  4. Check which messages were sent from the account while it was compromised and warn the customers affected.
  5. If the mailbox contains customers' personal data, assess whether the incident must be reported to the data protection authority within 72 hours.

Prevention

Multi-factor authentication stops most attacks on email. Correctly configured SPF, DKIM and DMARC records prevent fraudsters from sending emails in the name of your domain. Agree with your customers that any change of bank account is confirmed by phone.

Business emailIncidents