How to investigate business email compromise (BEC): from fraudulent email to full scope 

How digital forensics helps preserve evidence, reconstruct account activity, scope impact, and guide remediation

By Jeff Rutherford

In a business email compromise (BEC), the fraudulent message is often only the visible end of a longer campaign. Investigators must determine whether the attacker spoofed a trusted sender or controlled a legitimate account, how access was obtained, what was changed, what information was exposed, and whether financial or other unauthorized actions followed. An effective response requires a fact-based investigation that preserves critical evidence, reconstructs account activity, determines the full scope of impact, and uses those findings to guide containment and remediation.

This post walks through a five-phase forensic workflow for a BEC investigation, from evidence-guided containment to post-incident reporting, and the evidence that matters at each step.

Core principle of a BEC investigation: Contain account misuse without losing evidence

Every response action changes the environment investigators are trying to reconstruct. Disabling a compromised mailbox, resetting credentials, revoking tokens, or removing forwarding rules may stop immediate misuse, but those same actions can also alter the account state that helps show what the attacker did.

The goal is to contain with purpose: stop active harm; preserve critical mailbox, audit, authentication, and endpoint evidence when feasible; and retain enough forensic visibility to determine how the account was compromised, what the attacker accessed or changed, how long unauthorized activity persisted, and what must be remediated before normal operations resume.

Why business email compromise is different

BEC often relies on legitimate credentials, trusted business relationships, and ordinary-looking email activity. Unlike incidents that announce themselves with malware or encryption, a compromised mailbox can blend into normal operations.

The visible event may be a fraudulent invoice, an executive impersonation request, payroll diversion, or the unexpected disclosure of sensitive information, while the underlying account compromise began earlier and left only subtle traces.

Ultimately, the BEC investigation needs to answer these questions:

• Was the sender impersonated through spoofing, or did the attacker control a legitimate account?
• How did the attacker gain access, and were phishing, credential reuse, malicious links or attachments, or another method involved?
• Which user accounts, mailboxes, endpoints, or cloud resources were affected?
• Were forwarding rules, mailbox delegates, account settings, or other access mechanisms created or changed?
• What messages, attachments, or other data were accessed, sent, deleted, or redirected?
• Were credentials, authentication tokens, or sessions compromised?
• When did unauthorized activity begin, and how long did it continue?
• Were fraudulent financial transactions initiated, or was sensitive information disclosed?
• What must be reset, revoked, removed, or strengthened before the account can be trusted again?

A five-phase BEC investigation workflow

A BEC response is most effective when digital forensics is integrated throughout the incident response lifecycle. Two priorities run in parallel from start to finish:

• Stop active misuse and limit additional financial loss, unauthorized access, or disclosure.
• Preserve and analyze the evidence needed to distinguish impersonation from account takeover and determine broader impact.

The workflow below uses five practical phases that connect rapid containment with deeper mailbox, identity, cloud, and endpoint analysis.

Phase 1: Initial response and evidence-guided containment

The first priority is to stop ongoing digital fraud or unauthorized access, while documenting or preserving key evidence where possible. When no malware is present, mailbox and identity artifacts may be the clearest record of attacker behavior.

Initial triage should focus on:

• Identifying signs of compromise, including unusual financial requests, suspicious message patterns, unexpected forwarding rules, changed account settings, or anomalous sign-in activity.
• Using email security, cloud audit, authentication, and incident response telemetry to identify likely affected accounts, suspicious sessions, devices, IP addresses, or related activity.
• Determining whether unauthorized access is still active and whether a fraudulent payment, data disclosure, or other harmful action is in progress.
• Preserving mailbox state and relevant audit, authentication, message, and endpoint evidence before account changes when the risk and timing allow.
• Disabling affected accounts, resetting credentials, revoking compromised tokens or sessions, removing malicious rules, enabling or reinforcing multifactor authentication (MFA), and blocking suspicious infrastructure as required to stop further harm.

Phase 2: Evidence collection and building the forensic record

Once immediate containment priorities are addressed, investigators should build a forensic record that supports both rapid scoping and deeper analysis. Collection should be driven by the questions the investigation needs to answer, using targeted or broader acquisitions as appropriate to the account, endpoint, cloud service, and business impact involved.

The most valuable evidence depends on whether the incident involved account takeover, sender impersonation, credential theft, mailbox manipulation, endpoint compromise, or fraudulent transactions.

The following categories commonly provide critical context in BEC cases:

Evidence category	Examples	Investigative value
Mailbox content and metadata	Messages, folders, sent items, deleted messages, attachments, message timestamps	Helps reconstruct communications, identify unauthorized messages or deletions, and determine what content may have been exposed or used in the fraud.
Email headers and message provenance	Routing headers, sender information, domains, links, attachment metadata	Supports analysis of message origin, route, authenticity, spoofing, phishing, and related attacker infrastructure.
Mailbox configuration and audit data	Forwarding rules, inbox rules, delegates, account changes, mailbox audit logs	Can reveal persistence, redirection of communications, unauthorized configuration changes, and the sequence of activity inside the mailbox.
Authentication and identity evidence	Sign-in logs, IP addresses, devices, sessions, MFA events, credentials, tokens	Supports analysis of account takeover, unusual access, compromised authentication material, and the duration of unauthorized sessions.
Endpoint and browser evidence	Browser history, system logs, credential storage, local email artifacts, endpoint telemetry	May show phishing activity, credential access, malicious links or attachments, browser-based access, and related actions on the user device.
Cloud and security telemetry	Microsoft 365 or Google Workspace records, email security alerts, incident response logs	Provides account-level and cloud context that can be correlated with mailbox, identity, and endpoint evidence for broader scoping.
Financial and business records	Invoices, payment instructions, transaction records, related business communications	Connects technical evidence to fraudulent action, supports timeline reconstruction, and helps document financial impact or recovery efforts.

For distributed investigations, remote collection can help preserve endpoint evidence without waiting for a device to be physically shipped. If a suspected endpoint has already been isolated, local or offline acquisition can preserve relevant data without reconnecting the system to the production environment.

Phase 3: Forensic analysis, timeline, and scope

Analysis turns collected evidence into a clear account of what happened. The fraudulent email or payment request may be the event that triggered the investigation, but the analyst must work backward and outward to determine whether the attacker controlled a real account, how access was obtained, what was changed, and what else may have been affected.

Key forensic tasks include:

• Distinguish sender spoofing or impersonation from true compromise of a legitimate mailbox.
• Identify the likely method of compromise by analyzing phishing messages, malicious links or attachments, spoofed domains, browser activity, credentials, authentication records, and related artifacts.
• Reconstruct the timeline of unauthorized access using email timestamps, mailbox audit logs, authentication records, browser history, endpoint artifacts, and relevant financial transaction data.
• Analyze forwarding rules, mailbox delegates, account settings, deleted messages, and other changes that may show persistence, concealment, or redirection of communications.
• Correlate unusual sign-ins, devices, IP addresses, sessions, credentials, or tokens with mailbox actions to understand the sequence and duration of attacker activity.
• Determine what messages, attachments, or other information were accessed, sent, redirected, or deleted, and whether unauthorized financial transactions or disclosures occurred.
• Where useful, map attacker behavior to MITRE ATT&CK to communicate observed tactics and techniques.

A critical outcome is accurate scoping. A BEC investigation should not stop with the first fraudulent message or the first account that was reported. Forensic analysis should determine whether additional accounts, endpoints, cloud activity, credentials, tokens, or business processes were affected and whether any unauthorized access remains after initial containment.

Phase 4: Remediation and recovery, turning forensic findings into action

Recovery should be guided by what the investigation learned about the compromised account and the path used to access it. Resetting a password may stop one form of access, but it does not by itself establish that malicious forwarding rules, delegates, tokens, sessions, or related account changes have been removed.

Forensic findings can identify:

• Compromised credentials, tokens, sessions, or accounts that should be reset, revoked, disabled, or otherwise secured.
• Unauthorized forwarding rules, delegates, mailbox changes, or other access mechanisms that must be removed and validated.
• The initial compromise method and the email security, authentication, account management, or user awareness controls that need to be strengthened.
• Related endpoints or browser activity that require additional investigation or remediation because they may have enabled credential or session theft.
• The messages, data, or financial activity affected by the incident so legal, compliance, finance, insurance, and leadership teams can make informed decisions.
• Observed attacker behaviors and indicators that can be translated into stronger monitoring, filtering, authentication controls, and alerting.

Recovery actions may include restoring affected mailbox settings to a trusted state, removing unauthorized rules or delegates, resetting credentials, revoking tokens and sessions, enforcing MFA, strengthening email filtering and account controls, validating that no unauthorized access remains, and monitoring for recurrence based on the activity observed during the investigation.

Phase 5: Documentation, reporting, and post-incident improvement

BEC investigations often support executive decision-making, legal and compliance review, insurance requirements, financial recovery efforts, and coordination with law enforcement or other external parties. Documentation should clearly distinguish observed evidence, investigative conclusions, and response actions.

A final report should document, as appropriate:

• Whether the incident involved sender impersonation, account takeover, or both, and the evidence supporting that conclusion.
• The likely initial compromise method and root-cause findings.
• A timeline of unauthorized access, mailbox activity, account changes, and related financial or business events.
• Affected accounts, mailboxes, endpoints, cloud resources, messages, and data.
• Forwarding rules, delegates, credentials, tokens, sessions, or other mechanisms used to maintain or extend access.
• Relevant attacker infrastructure, message headers, domains, IP addresses, and indicators identified during the investigation.
• Forensic collection and analysis methodology.
• Containment, remediation, and recovery actions informed by the investigation.
• Lessons learned and recommended updates to logging, retention, email security, MFA, collection readiness, and incident response procedures.

From evidence to better response decisions

Forensic findings matter most when they change what the team does next. Across a BEC investigation, they support three key decisions:

Determine what actually happened
Establish whether the incident was limited to sender impersonation or involved control of a legitimate account. That distinction changes the evidence required, the scope of remediation, and the level of concern about mailbox access, credentials, tokens, and connected activity.

Understand the true scope
Determine which accounts, messages, endpoints, cloud records, and business processes were affected, what information may have been accessed or disclosed, and whether fraudulent financial activity occurred.

Remediate the access path, not just the visible fraud
Use findings around phishing, credential or token compromise, forwarding rules, delegates, account changes, and endpoint activity to determine what must be reset, revoked, removed, strengthened, or monitored before the incident can be considered contained.

How Magnet Forensics supports BEC investigations

BEC investigations rarely get the full story from a single message or log. Investigators may need to preserve and correlate evidence across cloud mailboxes, identity systems, endpoints, browsers, audit records, and business data.

• Magnet Axiom Cyber: Analyze email, cloud, endpoint, and browser artifacts; correlate activity; reconstruct timelines; and use IOC, YARA, and Sigma-informed workflows.
• Magnet Nexus: Support scalable remote endpoint collection across distributed environments when relevant systems remain available for remote acquisition.
• Magnet Response: Support local or offline acquisition from isolated endpoints when maintaining network containment is required.

These capabilities can be used together to preserve relevant evidence, correlate activity across mailbox, cloud, identity, and endpoint sources, reconstruct attacker activity, and support evidence-based scoping and reporting.

Prepare before the next incident

Teams cannot reconstruct a BEC incident under pressure if the relevant logging, retention, collection methods, roles, and evidence-handling procedures were never established. The quality and speed of the investigation depend heavily on forensic readiness before the first suspicious message is reported.

Key steps include:

• Define roles across incident response, IT, security, legal, compliance, finance, and business leadership.
• Maintain appropriate logging and retention for mailboxes, authentication systems, cloud services, endpoints, browsers, and email security platforms.
• Establish workflows for collecting cloud email and endpoint evidence before an incident occurs.
• Document evidence-handling, chain-of-custody, storage, and retention procedures.
• Ensure responders know how to preserve mailbox rules, audit records, message headers, and authentication evidence before making account changes when circumstances allow.
• Maintain and test MFA, email filtering, account management, and phishing response controls.
• Practice BEC response scenarios so technical, finance, legal, and leadership teams understand how containment, financial response, evidence preservation, and investigation should proceed in parallel.

Treat BEC as an investigation, not just an account reset

Disabling an account or resetting a password may stop the immediate misuse, but it does not explain how the attacker gained access, what they read or changed, whether messages or payments were redirected, what data may have been exposed, or whether related credentials, tokens, or accounts remain compromised. Digital forensics provides the evidence needed to reconstruct the incident, determine its true scope, and make informed remediation decisions.

Moving quickly and investigating thoroughly can happen together: contain with purpose, preserve the mailbox and identity evidence that matters, and use what the investigation reveals to guide a more complete recovery.