Do Business Email Compromise Attempts Usually Look Suspicious to Email Security?

Security controls can work as intended and still be bypassed by user decisions. Messages may be quarantined, but if someone releases a suspicious email or follows through on the request, the account can still be compromised. User awareness, clear escalation procedures, and limiting risky actions are important alongside the technical controls.

Automated detection and remediation may not trigger until after the attacker has already accessed the account or completed the main objective. Phishing-resistant MFA is one of the strongest defenses, and identity policies that detect unusual sign-ins—such as impossible-travel activity—can add another layer when the necessary licensing and configuration are available.

In Microsoft 365 environments, detection can happen at several different points. Identity protection may flag a suspicious sign-in, outbound anti-spam controls may stop the account after unusual sending activity, or the user may report missing mail, which can lead to discovering malicious forwarding rules. These layers catch incidents at different stages, and the issue seems less common when they are configured and monitored properly.

In many cases, the technical indicators are limited because the main weakness is social engineering. The attacker may use a legitimate account, familiar wording, or a convincing impersonation, so the message can appear normal. The manipulation is often based on urgency or authority, though some attackers spend weeks building trust before making a financial or access-related request.