Business Email Compromise is the highest-loss cyber crime category tracked by the FBI. Defending against it requires both external email authentication hygiene (so attackers cannot impersonate you) and internal tenant audit (so attackers cannot persist inside you). LeakTrace covers both, in one product.
| Stage | Attacker action | Our coverage |
|---|---|---|
| 01Reconnaissance | Identify the target's email tenant and authentication posture | ✓External audit — SPF, DMARC, DKIM, MTA-STS audit on the public domain |
| 02Initial access | Phishing email lands in employee inbox impersonating a vendor or executive | ✓External audit — DMARC enforcement check; spoofed mail rejected at the receiving mail server |
| 03Credential theft | User enters credentials on an adversary-in-the-middle proxy page | △User education plus Mailbox Shadow Audit sign-in anomaly detection — detected post-event, not prevented |
| 04MFA bypass | Session cookie replayed; MFA never re-prompted | ✓Mailbox Shadow Audit — Conditional Access policy review, session lifetime audit, token binding posture |
| 05Persistence | Inbox rule auto-deletes or hides replies from the real recipient | ✓Mailbox Shadow Audit — Inbox rule audit across every mailbox in the tenant |
| 06Discovery | Attacker reads invoice and payment threads to learn vendor cadence | ✓Mailbox Shadow Audit — Mailbox audit log review for anomalous reads and search activity |
| 07Exfiltration | Wire fraud or vendor invoice swap; redirected funds leave the building | ✓Mailbox Shadow Audit — Forwarding rule and external recipient detection on every account |
BEC happens after the perimeter. By the time the attacker is creating an inbox rule or wiring fraud, every prevention control you bought has already done its job and let them through. The FBI tracked over $55 billion in losses across tenants that were, by every standard measure, secure. Here's what each layer of your stack does — and what it misses.
| Stack layer | What it does | What it misses |
|---|---|---|
| Multi-factor authentication (MFA) | Verifies a second factor at sign-in | AiTM session-cookie theft. The attacker steals the cookie after MFA passes — for the cookie's lifetime, the attacker is authenticated. FBI: 80%+ of BEC victims had MFA enabled. |
| Email security gateway | Filters inbound malicious email | The inbox rule the attacker created after getting in. The forwarding config silently routing invoices out. Anything inside the tenant. |
| Endpoint detection (EDR) | Detects malware on laptops and servers | The cloud tenant. EDR has no agent inside Microsoft 365 or Google Workspace. BEC happens entirely in the tenant. |
| SIEM / log aggregation | Aggregates logs for correlation | The specific BEC patterns: impossible travel, MFA fatigue, new inbox rule, recent device — all chained. Default rules don't catch the chain. |
| SOC 2 / ISO 27001 audit | Validates org-level controls | Per-user mailbox config. A SOC-2-clean tenant can have a CEO's inbox auto-forwarding to gmail.com right now. |
| Cyber insurance | Pays out after a covered loss | "Social engineering" exclusions are expanding. Major carriers tightened BEC coverage across 2024–2025 renewals. Many recent payouts have been reduced or denied. |
Sources: FBI IC3 PSA I-061124-PSA (2024), Microsoft Digital Defense Report 2023, Verizon DBIR 2024.
| Audit | What we look for | MITRE ATT&CK |
|---|---|---|
| Inbox rule audit | Hidden auto-forward to attacker; rules that move mail to RSS Feeds, Conversation History, or Deleted Items | T1564.008 |
| Forwarding config | Tenant-wide external forward enabled; SMTP forwarding to a non-business domain | T1114.003 |
| MFA enrollment | No MFA registered, or SMS-only MFA, on executive and finance accounts | T1078.004 |
| Auth methods | Phone numbers registered in non-business country codes; voice-call MFA on privileged accounts | T1098.001 |
| Conditional Access | Legacy authentication not blocked; no geographic restriction; no risky sign-in policy | T1078.004 |
| Sign-in logs | Impossible travel; MFA fatigue spray; sign-ins from Tor exit nodes or hosting ASNs | T1110.003 |
| Devices | Stale registered devices; generic device names that suggest BYOD without enrollment | T1098.005 |
| Session lifetime | Cookies long-lived past acceptable thresholds; Continuous Access Evaluation disabled | T1539 |
An inbox rule on the accounts payable mailbox forwards every message containing the words invoice, wire, or routing to an external Gmail address, then moves the original message to the RSS Feeds folder. The rule is owner-set, was created outside the configured maintenance window, and is invisible from the user's main inbox view.
# Get-InboxRule output, sanitized Identity : [email protected]\\auto-archive-invoices Enabled : True SubjectContains: [invoice, wire, routing] ForwardTo : [email protected] MoveToFolder : RSS Feeds MarkAsRead : True StopProcessing: True This is the textbook persistence pattern that follows credential compromise on a finance role. The attacker silences vendor replies so the legitimate user never sees the conversation, and stages a wire-fraud or invoice-swap for the next vendor cycle. Average dwell time before discovery in cases we have triaged is between 9 and 22 days.
Disable the rule, force a credential and session reset on the affected account, audit the last 30 days of sent items and sign-in logs for the same mailbox, and apply a tenant-wide policy that blocks the creation of inbox rules with external forwards. We walk you through each step on the included remediation call.
External email authentication audit only. You see the SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, and DNSSEC posture, plus the synthesized BEC Susceptibility Score for your domain.
Everything in the free scan plus the read-only tenant audit: 8 internal checks across inbox rules, forwarding, MFA, devices, sign-in logs, conditional access, and session lifetime — with a written PDF report and remediation calls included.
External email authentication checks follow the published standards: RFC 7208 Sender Policy Framework, RFC 7489 Domain-based Message Authentication, Reporting and Conformance, RFC 6376 DomainKeys Identified Mail, RFC 8461 SMTP MTA Strict Transport Security. Internal tenant audits use the published Microsoft Graph and Google Workspace Admin SDK endpoints only.