Business email compromise cost US organizations $3.04 billion in reported losses in 2025 — the second-largest loss category the FBI tracks. When you discover a compromised mailbox, you're usually discovering it late: the attacker has typically been reading for weeks, and the fraudulent payment is how they cashed out. The response has two clocks running at once — the money clock and the access clock.

The money clock (hours)

If any payment moved or any payment details changed under the compromised mailbox's influence: run the wire fraud first-48-hours sequence now — bank recall, IC3 filing, insurer notice — and freeze every pending payment associated with threads the mailbox touched. Then audit 90 days of payment-detail changes and re-verify each by callback to numbers on file. Assume every instruction that passed through the mailbox is suspect until verified.

The access clock (same day)

  1. Preserve first: export the mailbox, sign-in logs, and rule configurations before touching anything — evidence dies in cleanup.
  2. Then evict: reset credentials, revoke all active sessions and app passwords, and re-enroll MFA. A password reset alone doesn't end active sessions.
  3. Hunt the persistence: attackers add hidden inbox rules (auto-forwarding to external addresses, auto-deleting security alerts and replies), mail delegates, and OAuth app grants. Remove all of them. The forwarding rule is how they'll watch your response.
  4. Scope sideways: check whether the account was used to phish colleagues or counterparties — BEC spreads through reply-chains, and your compromised thread is now someone else's incoming fraud.

The counterparty problem

If your mailbox was used to defraud a customer or vendor — fake invoices from your real domain — you have a notification decision with legal and commercial weight. Involve counsel early, but bias toward fast, factual notification of affected counterparties: they can still stop payments you can't, and silence ages terribly in later disputes about who could have prevented what.

The week-one review

Two questions determine whether this repeats. Technical: how did they get in, and is MFA enforced everywhere including legacy protocols? Procedural: why could an email — any email, from anyone — move money or change payment details without out-of-band verification? The first question is IT's. The second is the payment approval process, and it's the one that decides whether the next compromised mailbox costs you anything at all.

Protocol tipBEC monetizes one assumption: that email is an instruction channel. Demote it to a notification channel — instructions execute only after out-of-band verification — and a compromised mailbox becomes a nuisance instead of a loss.