detecting-business-email-compromise

Detect BEC by flagging emails with VIP display names from external domains, checking Reply-To address mismatches, alerting on financial keywords combined with urgency language, and monitoring first-time senders contacting finance or accounting staff.

Authentication passes because attackers use cousin domains or free webmail accounts that are valid for their own domain while the display name reads as an executive. Authentication passing does not mean the brand is genuine, so alert on VIP display names paired with external domains.

Detect compromised mailboxes by alerting on inbox rule creation (T1114.003), impossible travel in login locations, auto-forwarding rules that hide replies, and mailbox delegation changes. These indicators catch attacks sent from legitimate internal accounts.

Microsoft Defender for Office 365 includes built-in anti-BEC detection, Proofpoint Email Fraud Defense and Abnormal Security offer dedicated BEC solutions. Combine these with SIEM-based behavioral analytics and financial controls like dual-authorization for wire transfers.

Reduce false positives by whitelisting legitimate first-time senders such as recruiters and new vendors by role, and validating rules with test scenarios like CEO gift-card requests and vendor bank changes. This keeps finance and AP alerts low-noise while maintaining coverage.