Signs Your Business Email Has Been Compromised (and What to Do First)

Business email is the master key to your company. It holds password resets, financial approvals, vendor relationships, and customer data. When attackers gain access, they rarely make noise — they watch, wait, and strike when a wire transfer or invoice is in motion. Knowing the warning signs early can mean the difference between a contained incident and a five-figure loss.

What Are the Warning Signs of a Compromised Business Email?

Business email compromise (BEC) usually shows up as small anomalies before a major event. Watch for these signals:

• Sent items you don't recognize, or a suspiciously empty Sent folder (attackers delete their tracks).
• Inbox rules you didn't create, especially rules that auto-forward, auto-delete, or move messages about "invoice," "payment," or "wire" to an obscure folder.
• Contacts reporting spam or odd requests that appear to come from you.
• Login alerts from unfamiliar locations, devices, or IP addresses, or sign-ins at hours when no one is working.
• Password reset emails for other accounts (banking, payroll, social) that you didn't request.
• Missing or already-read messages you never opened, or replies to threads you never saw.
• Multi-factor authentication (MFA) prompts you didn't trigger — a sign someone has your password and is testing it.
• Disabled security settings, or a new MFA method, app password, or forwarding address added to your account.

Any single sign can be benign. Two or more together should be treated as a probable compromise.

Why Do Attackers Target Business Email?

Email accounts are high-value because they grant downstream access. With inbox control, an attacker can reset passwords on connected services, read confidential negotiations, impersonate executives, and redirect payments. In BEC and "vendor email compromise" schemes, criminals study real invoice threads, then send a legitimate-looking message asking that future payments go to a new bank account. Because the email comes from a genuine, trusted address, it bypasses the instincts that catch obvious phishing.

What Should You Do First If You Suspect a Compromise?

Act in order. Speed limits the damage.

1. Change the password immediately — from a device you trust, not the possibly infected one. Use a long, unique passphrase.
2. Sign out all active sessions. Most platforms (Microsoft 365, Google Workspace) offer a "sign out everywhere" or "revoke sessions" option that kicks the attacker out instantly.
3. Enable or reset MFA, and remove any MFA methods or app passwords you don't recognize.
4. Inspect and delete malicious inbox rules and forwarding addresses. This is the most-overlooked step — attackers often keep reading your mail through forwarding even after a password change.
5. Check account recovery settings (backup email, phone number) for anything you didn't add.
6. Review sign-in and audit logs to understand what was accessed and when.
7. Warn your team, finance department, and key vendors not to act on recent payment or banking-change requests until verified by phone.
8. Preserve evidence. Don't mass-delete; you may need logs for insurance, legal, or law-enforcement reporting.

How Do You Verify a Suspicious Payment or Request?

Use out-of-band verification: confirm any banking change, wire request, or gift-card purchase through a separate, known channel — a phone call to a number you already have on file, never the number or reply address in the suspect email. Treat urgency and secrecy as red flags; both are core tactics in BEC.

How Can You Prevent Email Compromise Going Forward?

• Require phishing-resistant MFA on every account.
• Enforce unique passwords with a password manager.
• Configure email authentication (SPF, DKIM, and DMARC) to make spoofing your domain harder.
• Enable alerts for new inbox rules, forwarding, and unusual sign-ins.
• Run regular phishing-awareness training for staff.
• Establish a written verification policy for any payment or banking change.
• Keep logging and monitoring active so anomalies surface quickly.

When Should You Bring in a Professional?

If financial transactions, customer data, or multiple accounts may be affected — or if you simply aren't sure the attacker is fully removed — engage a cybersecurity provider. Professionals can confirm the scope of access, eliminate persistence mechanisms like hidden forwarding rules, harden your configuration, and help with reporting obligations. The cost of expert response is almost always lower than the cost of a successful fraudulent transfer.

About RoboZilla

RoboZilla helps small and mid-sized businesses defend against threats like business email compromise through RedCore, its cybersecurity service, alongside business automation and AI-powered lead generation. RedCore covers email security hardening, MFA and identity protection, monitoring, and incident response — so your team can act fast when minutes matter and stay protected the rest of the time. If you suspect your business email has been compromised, or want to prevent it, reach RoboZilla at [phone] or visit https://robozilla.ai.

---

RoboZilla — cybersecurity (RedCore), business automation & AI lead generation for small & mid-sized businesses. https://robozilla.ai · [phone]