For those who have handled business email compromise incidents, how was the attack detected? Did authentication or email-security tools flag unusual activity, or did the messages and sign-ins look normal until a person noticed something was wrong? I'm especially interested in whether the social engineering was a quick urgency-and-authority scam or a longer effort to build trust before making the request.
4 Answers
In many cases, the technical indicators are limited because the main weakness is social engineering. The attacker may use a legitimate account, familiar wording, or a convincing impersonation, so the message can appear normal. The manipulation is often based on urgency or authority, though some attackers spend weeks building trust before making a financial or access-related request.
In Microsoft 365 environments, detection can happen at several different points. Identity protection may flag a suspicious sign-in, outbound anti-spam controls may stop the account after unusual sending activity, or the user may report missing mail, which can lead to discovering malicious forwarding rules. These layers catch incidents at different stages, and the issue seems less common when they are configured and monitored properly.
It’s useful to think of those as separate detection opportunities rather than one system catching everything. A sign-in alert, outbound-mail threshold, or mailbox configuration review can each reveal a different part of the attack.
Automated detection and remediation may not trigger until after the attacker has already accessed the account or completed the main objective. Phishing-resistant MFA is one of the strongest defenses, and identity policies that detect unusual sign-ins—such as impossible-travel activity—can add another layer when the necessary licensing and configuration are available.
Security controls can work as intended and still be bypassed by user decisions. Messages may be quarantined, but if someone releases a suspicious email or follows through on the request, the account can still be compromised. User awareness, clear escalation procedures, and limiting risky actions are important alongside the technical controls.
That matches what I’ve seen too. The short, urgent scams are easier to spot, while the longer trust-building attempts can blend into normal business communication.