Business email compromise combines account intrusion, impersonation and payment fraud. Rapid coordination matters because both logs and transferred funds can become harder to reach.
Contact the financial institution
Use a verified number and request an urgent fraud escalation. Record the reference number and the exact time of contact.
Preserve cloud audit data
Mailbox rules, forwarding settings, sign-in logs, application consents and message traces may explain the compromise.
- Do not delete suspicious rules before documenting them
- Export relevant audit logs
- Preserve original emails
- Record administrator actions
Build a verified timeline
Separate confirmed activity from assumptions. A reliable timeline supports containment, reporting and later legal review.