How a Business Email Compromise Investigation Actually Works

A business email compromise investigation answers four questions: how the attacker got in, what they read, what they changed, and whether any of that triggers a notification obligation. Whether those questions are answerable depends on what your tenant was logging before the incident. Microsoft's own documentation puts unified audit log retention at 180 days for Purview Audit (Standard), and narrowing that to individual messages depends on the MailItemsAccessed mailbox action, which is audited by default for owner, delegate and admin sign-ins, which only records events from the point it is active in your tenant, and which identifies individual messages only for one of the two ways mail gets accessed. Microsoft announced in July 2023 that "detailed logs of email access and more than 30 other types of log data previously only available at the Microsoft Purview Audit (Premium) subscription level" would roll out to all customers from September 2023. The FBI's Internet Crime Complaint Center put reported business email compromise losses at $2,770,151,146 in its 2024 IC3 Annual Report. If money moved, the recovery window is measured in hours.

This article walks the investigation in the order it actually happens: the money first, then the four questions, then the artifact list, then the legal step that most technical write-ups skip.

Key takeaways

• Chase the money before you chase the attacker. Bank recall and the FBI's IC3 process both work on a clock measured in hours, and an investigation that starts with forensics has already spent the window.
• The four questions are entry, read scope, changes made, and notification exposure. Only the first and third are reliably answerable from default logging.
• Microsoft 365 Purview Audit (Standard) retains unified audit records for 180 days. Entra ID sign-in logs get seven days on the free tier and thirty on P1 or P2. Neither default is generous.
• MailItemsAccessed is what turns "the mailbox was accessed" into a scope, but the resolution depends on how the mail was accessed: bind operations name individual messages, while sync operations name only the folder, and every item in a synced folder is then treated as compromised. It records forward from the moment it is active, so enabling it after an incident does not help that incident.
• Multi-factor authentication does not close the question. Adversary-in-the-middle phishing steals the session token after the prompt, so a clean MFA log is not evidence that MFA held.

Hour zero: the money moves faster than the investigation

If a payment went out, or a vendor's bank details were changed, the first hours belong to the money and not to the examiner.

Call your bank's fraud line and ask for a recall, in that phone call, not by email. Then file with the FBI's IC3. IC3's Recovery Asset Team runs the Financial Fraud Kill Chain, the mechanism through which a fraudulent wire can be frozen at the receiving institution, and it covers domestic and international transactions alike. The 2024 IC3 Annual Report records 3,020 kill chain complaints that year over $848.4 million of attempted theft, with $469.1 million frozen on the domestic side and $92.5 million on the international side, a 66 percent success rate. Do not talk yourself out of filing on a threshold you half-remember. File, and file fast, because a freeze only works while the funds are still sitting at the receiving bank.

Two things to do in parallel.

Copy the evidence, then contain, and do not reverse that order into a delay: export the inbox rules, the forwarding and transport configuration, the delegate and permission list and the mailbox audit records, screenshot what will not export, and then immediately block sign-in on the compromised account, revoke its sessions and refresh tokens, reset the credential, and remove the malicious rules and forwarding. An account still under attacker control is an account still exfiltrating mail and still sending fraudulent instructions in your name, so preservation means taking a copy, not leaving the door open while the bank, IC3, your insurer or an examiner gets back to you. What nobody should do is "tidy up" the mailbox before that export exists.

And notify your cyber insurer's claims line. Most policies condition coverage on prompt notice and on using panel vendors, and a BEC with a wire loss is exactly the claim that gets scrutinized.

Only then does the forensic work start.

The four questions, and what answers each one

How did they get in? Usually credential phishing, an adversary-in-the-middle proxy that captures the session token after a successful MFA prompt, password reuse against a service that leaked, or a malicious OAuth application consent granted by the user. Sign-in logs plus consent-grant records usually answer this one, if they are still in retention.

What did they read? This is the question the business actually cares about, because it drives notification, and it is the hardest to answer. The mailbox audit record that logs mail access is what separates "someone was in the mailbox for eleven days" from a bounded set: forty-two named messages where the access was message by message, or a named folder treated as exposed in full where the attacker synced it to a client. Without that record you are reasoning from what was in the mailbox rather than from what was touched, which is a much weaker position with a regulator.

What did they change? Inbox rules that file or delete vendor correspondence, SMTP forwarding to an external address, mail transport rules, mailbox delegate permissions, new MFA methods registered so the attacker keeps access after the password reset, and changes to reply-to addresses on outbound invoices. These are usually recoverable from audit records and they are also the evidence that the intrusion was operational rather than opportunistic.

Does this trigger notification? A legal question resting on the first three answers, which we come back to below.

Your logging tier decides what is knowable

This is the part that nobody wants to hear during an incident, because it cannot be fixed retroactively.

Microsoft's Purview Audit documentation puts unified audit log retention at 180 days on the standard tier, with longer retention available on the premium tier and via add-on. Microsoft Entra ID sign-in and audit logs run on a separate and much shorter schedule: seven days on Entra ID Free, thirty on P1 or P2, so the answer for your tenant is a licensing fact rather than a preference. Google Workspace retention likewise varies by log type and edition, and the current values live in the Google admin documentation rather than in anyone's blog post.

MailItemsAccessed deserves its own paragraph because it is where most BEC investigations succeed or fail. Microsoft's mailbox auditing documentation lists it as a default-audited action for owner, delegate and admin sign-ins, described as occurring "when mail data is accessed by mail protocols and clients," which is what lets an examiner bound the read scope. Microsoft said in July 2023 that email-access logs previously confined to Audit (Premium) would reach all customers from September 2023, so many tenants now have this where they once did not.

Three caveats matter, and the first one decides how precise the answer can be.

MailItemsAccessed covers two kinds of access, and only one of them names messages. Microsoft's investigation guidance describes bind access as "an individual access to an email message," where "the InternetMessageId of individual messages is recorded in the audit record," aggregated into one record per two-minute interval. Sync access is different: it is recorded when a desktop Outlook client downloads a set of items, and because "the audit volume for sync operations is huge," the system "generates an audit event for the mail folder containing items that were synced" instead of one per message. Microsoft's instruction for that case is unambiguous: "All mail items in the synced folder are assumed to be compromised," and if a sync happened in the attacker's context you should "assume the bad actor synced all mail items to their client, which means the entire mailbox is compromised." So a clean bind list is not the whole answer until you have checked for syncs, and an investigation that reports only the bound messages can under-scope the exposure badly.

The second caveat: it records events going forward from the point it is active, so switching it on today does nothing for an intrusion that started last month.

The third: "available on your tier" is not the same as "enabled and retained in your tenant," which is a thing to verify in the admin center on a calm afternoon rather than to assume mid-incident.

The practical consequence: an intrusion discovered inside the retention window with mailbox auditing active can usually be scoped, precisely where the access was message by message and at folder granularity where it was a sync. The same intrusion discovered at month seven, on default settings, frequently cannot be scoped at all, and the report will say so.

The artifact list an examiner works through

In roughly this order, because each answer narrows the next question:

• Sign-in logs, including non-interactive and legacy-protocol sign-ins, filtered for the compromised principals. Look at source addresses, autonomous systems, user agents, and the shape of the session rather than at geography alone; consumer VPNs make location a weak signal.
• Consent grants and enterprise application registrations, because a malicious OAuth app survives a password reset and a token revocation is required to remove it.
• Inbox rules and forwarding, across every mailbox the attacker touched, not just the one that was reported.
• Mailbox permission and delegate changes, which is how one compromised account becomes access to an executive's mail.
• Authentication method registration events, which show whether the attacker registered their own MFA method to keep persistence.
• Mailbox item access records, where available, to convert presence into read scope, reading the sync records before the bind records so that a synchronized folder is scoped as exposed in full rather than reduced to the handful of messages that were also opened individually.
• Message trace and transport data, to identify what was sent from the account, to whom, and whether your customers received fraudulent instructions in your name.
• Endpoint evidence, where there is any reason to believe the compromise extended past the tenant.

Two habits separate a good investigation from a fast one. Examine every mailbox the attacker had rights to rather than only the reported one, because delegate access is routine and under-checked. And check outbound activity as carefully as inbound: the reputational and contractual exposure from fraudulent invoices sent to your customers is frequently larger than the loss you suffered directly.

From "they were in the mailbox" to "notification is triggered"

The technical finding is the input to a legal analysis, not a substitute for it, and this is where a purely technical report leaves the buyer stranded.

Most breach statutes turn on whether personal data was accessed or acquired, not on whether it was sitting in a mailbox that someone entered. Mailboxes are the worst-case container for this: years of attachments, spreadsheets sent "just this once," identity documents, benefits paperwork. The scoping exercise that follows a BEC is often a document review of the mailbox contents rather than more log analysis, and it is frequently the largest single line in the bill.

The clocks are unforgiving and they start on different events, from GDPR's awareness trigger to HIPAA's discovery trigger to the SEC's materiality determination. We laid out the full crosswalk in Breach Notification Deadlines: Every Clock You Are On. The operational point for a BEC specifically: the moment your investigation establishes that a mailbox containing regulated data was accessed, at least one clock is probably already running, and "we are still investigating" is not a defense to a missed deadline.

Counsel owns this analysis. Your examiner's job is to give counsel findings precise enough to be useful, including an explicit statement of what could not be determined, because the boundary of the evidence is itself a fact counsel needs.

Why these investigations end inconclusive, and when not to buy one

We sell digital forensics, and the honest version is that a meaningful share of BEC engagements end with a report that cannot answer the read-scope question. Here is when to spend and when not to.

Do not buy a full engagement when the evidence is already gone. If the intrusion predates your retention window, mailbox auditing was not active, and the account was reset and cleaned before anyone thought about preservation, an examiner will produce a careful document explaining the limits of what can be known. Sometimes that document is worth buying, because an insurer or a regulator wants the attempt on record and because a defensible "cannot be determined" is better than a guess. Frequently it is not, and a firm that will not tell you which case you are in before invoicing is not a firm to hire.

Do not buy one for an incident with no regulated data and no loss. A single phished account, caught in an hour, no wire, no sensitive mailbox contents, rules removed and tokens revoked. Document it, fix the control gap, move on.

Do buy one when a wire moved, when the mailbox held regulated or contractual data, when your insurer is involved, or when customers received messages from your domain. Those are the situations where somebody outside your company will rely on the answer, which is the general test for forensics we set out in Digital Forensics vs Incident Response: Which Do You Need?.

Where Top Floor fits

Most BEC work sits in the seam between IT and counsel, and that seam is where we are useful. We scope digital forensics to the questions counsel actually has to answer rather than to the number of mailboxes involved, we say plainly at the outset which of the four questions your logging can support, and we write the read-scope finding with its confidence and its limits stated rather than implied.

Where the compromise looks like it reached past the tenant, that runs with incident response so that token revocation, credential resets, and evidence preservation are sequenced by one team instead of raced by two.

How to decide this week

1. Check, in your admin center, what your unified audit log retention actually is and whether mailbox item access auditing is active. Write down the answer. That single check decides how much a future investigation can tell you.

2. Extend retention on the log sources that would carry a mailbox compromise. This is licensing and configuration, not headcount.

3. Put the bank fraud line, the IC3 URL, and your insurer's claims number on the same card as your IT escalation contacts. During a BEC, whoever finds it first needs all three.

4. Change your payment-change process so that bank detail changes require verbal callback to a number on file, never to a number in the email. Most BEC losses die at that control.

5. Agree in advance who runs the mailbox content review, because that is the part of the bill people do not see coming.

The uncomfortable summary: the investigation you can afford after a BEC was determined by a retention setting you chose, or failed to choose, months earlier.

Frequently asked questions

Can a forensic investigation tell me which emails the attacker read?

Sometimes, and with an important limit. It requires that mailbox item access auditing was active in your tenant during the intrusion and that the records are still within retention, and even then the resolution depends on how the attacker read the mail. Where they opened messages individually, Microsoft's MailItemsAccessed records name each one by its internet message ID. Where they synchronized a folder to a desktop Outlook client, Microsoft records a single event for the folder rather than one per message, and its own guidance is that every item in that folder should be assumed compromised. So the honest output is often a named list for part of the period and a folder treated as exposed in full for the rest. Microsoft said in July 2023 that email-access logs previously confined to Audit (Premium) would reach all customers from September 2023. The auditing records events going forward from the point it becomes active, so enabling it after discovering an incident does not recover the earlier period. Without it, an examiner can usually establish that access occurred and for how long, but the read-scope question has to be answered by reviewing what the mailbox contained rather than what was touched.

How long are Microsoft 365 audit logs kept?

Microsoft's documentation puts unified audit log retention at 180 days for Purview Audit (Standard), with one year available on the premium tier and a ten-year retention add-on offered separately. Entra ID sign-in and audit logs are retained on their own much shorter schedule, seven days on Entra ID Free and thirty on P1 or P2, which depends on your licence tier rather than on a setting you can simply switch. Because these are vendor defaults that change, verify the current values against Microsoft Learn for your specific tenant and licences rather than trusting a figure in an article. The practical point is that an intrusion discovered after the window has closed cannot be reconstructed from logs that no longer exist.

What should I do first after discovering a business email compromise?

Deal with the money and the evidence at the same time, and in that order of urgency. Call your bank's fraud line by phone to request a recall of any fraudulent payment, file a report with the FBI's IC3, and notify your cyber insurer's claims line, because policies commonly condition coverage on prompt notice and panel vendors. In parallel, copy the evidence and then contain, in that order and without a pause between them: export the inbox rules, forwarding and transport configuration, delegate permissions and mailbox audit records, then block sign-in, revoke sessions and refresh tokens, reset the credential, and remove the malicious rules and forwarding. Containment is not something to defer while you wait on the bank or the insurer, because an attacker who still holds the mailbox is still reading and still sending. Treat the persistence question (registered MFA methods, OAuth consent grants, delegate access) as part of the same pass, because a password reset alone does not evict any of them. Then start the forensic work.

Does multi-factor authentication prevent business email compromise?

It raises the bar considerably and it does not close the question. Adversary-in-the-middle phishing proxies the real login page, captures the session token after the user completes a legitimate MFA prompt, and replays the session, which means the sign-in logs can show a successful MFA event that the attacker rode rather than defeated. Malicious OAuth application consent is a second path that never touches the password at all. Phishing-resistant methods based on hardware-backed credentials remove most of the token-theft path, which is why they are worth the migration effort for finance, executive, and administrator accounts first.