Business Email Compromise

Business email compromise is a fraud or intrusion pattern involving unauthorized access to email accounts or deceptive email activity.

It often involves wire fraud, vendor payment changes, mailbox rules, suspicious logins, and account persistence.

Preserve mailbox audit logs, message headers, login history, forwarding rules, and affected messages.