Glossary
Business email compromise (BEC)
Fraud in which an attacker uses or impersonates a trusted mailbox, typically to divert payments or steal data, often after taking over a Microsoft 365 account.
Business email compromise (BEC) is fraud carried out through e-mail that looks legitimate because it comes from, or convincingly imitates, a trusted mailbox: a supplier announcing new bank details, an executive asking for an urgent transfer. In Microsoft 365 the most damaging variant uses a real, compromised account, so messages pass every sender check.
A typical takeover leaves traces in three logs: a suspicious sign-in (Entra ID sign-in logs), persistence such as a new MFA method or OAuth consent (Entra audit logs), and inbox rules, forwarding, mail access and sends (Unified Audit Log). The FBI's IC3 recorded 21,442 BEC complaints and about $2.77 billion in losses in 2024.
See the Microsoft 365 BEC investigation guide and what to do in the first hour.