Business Email Compromised: A First Response Checklist

If someone may have accessed your business email, treat it as an incident to coordinate, not just a password to change. Contact your authorized IT administrator through a trusted channel, pause questionable payment instructions, and start a short record of what happened. Avoid using the affected mailbox to discuss recovery.

An unexpected sign-in alert, messages you did not send, or a supplier questioning new bank details can be warning signs. None alone proves account takeover: a forged sender address can also look convincing. Record what you actually observed so the investigation can distinguish a compromised account from impersonation.

This checklist is for an owner or office manager working with IT after suspected mailbox access. It is not a substitute for a provider-specific incident response plan. For businesses across NY, NJ, CT and Florida, the practical goal is the same: give the right person clear authority, reliable facts and a way to communicate safely.

1. Establish a trusted response channel

Call your existing IT contact using a number already in your records. Do not use the contact details in the suspicious email or let someone who unexpectedly calls you take remote control. Agree on a separate channel for updates and name one business decision-maker.

Create a simple division of responsibilities. The owner approves operational decisions and coordinates staff. Authorized IT investigates access and carries out technical containment. The finance contact handles payment verification. A small company may have one person covering several roles, but each decision still needs an owner.

Tell affected staff where legitimate updates will come from. Keep incident details in a restricted record rather than a company-wide chat. Our cybersecurity services page outlines the relevant support area when you need help organizing those responsibilities.

2. Separate payment protection from account recovery

Do not wait for a complete technical diagnosis before checking a questionable payment. Pause any unverified request to change supplier banking information, send an urgent transfer or buy gift cards. Confirm instructions through a previously established phone number, not by replying to the same conversation.

If a fraudulent transfer may already have occurred, the FBI's business email compromise guidance advises contacting the financial institution immediately to request a recall and reporting the incident to IC3. Recovery is not guaranteed. Keep transaction details available for the bank without circulating them unnecessarily among staff.

For example, a bookkeeper might receive an apparently familiar supplier thread with a new account number. The immediate business task is independent verification. Whether the sender's mailbox, your mailbox or neither was compromised is a separate investigation question.

3. Give authorized IT a containment checklist

For Microsoft 365, Microsoft's compromised-account response guidance recommends disabling the affected account while investigating. Authorized administrators should also address the password, revoke active sessions, review MFA methods, application permissions and admin roles, and remove unauthorized forwarding or inbox rules. Record changes and preserve relevant evidence alongside containment.

Do not send replacement credentials through the compromised mailbox. Hybrid environments may require recovery at a different identity source; let the administrator select the correct procedure. Review sign-in activity, audit records and message traces to establish scope. A password reset by itself does not finish this work.

Ask what access may remain

Microsoft's access-revocation documentation explains that applications can maintain their own sessions. Revoking access does not necessarily terminate every application session immediately. Ask IT to identify connected applications and confirm what additional containment is needed rather than assuming one sign-out action closes everything.

If your organization uses another email provider, follow that provider's current administrator recovery process. The Microsoft 365 and cloud services page is relevant for planning ongoing account administration, but incident actions must match the system actually in use.

4. Build a timeline without destroying evidence

Start with the first unusual event you know about, not a guessed attack start time. Record local time and time zone, the mailbox involved, the alert or message observed, who reported it and which actions followed. Separate confirmed facts from open questions.

Keep original suspicious messages and ask IT how to preserve them safely. Do not forward malicious attachments around the office for opinions. Avoid casually deleting rules, wiping devices or clearing logs before IT has considered evidence needs; urgent containment should still proceed under the response lead's direction.

Record business impact separately: delayed invoices, unanswered customer messages or uncertain payment instructions. This helps the owner make continuity decisions without exposing mailbox contents to everyone. Whether external notifications or specialist advice are required depends on the facts; involve appropriate legal, insurance or incident-response contacts rather than guessing.

5. Use this copyable incident handoff worksheet

Copy these fields into your restricted incident record. Write “unknown” where the answer has not been established; a blank field can look like a completed check.

Incident owner and trusted contact method:

Affected mailbox and first observed event, time and time zone:

Confirmed facts versus suspected activity:

Payment instructions paused or independently verified:

IT contact, containment actions, owners and completion times:

Evidence location and people permitted to access it:

Other accounts, applications or recipients under review:

Business workarounds and staff communication owner:

Open questions, next review time and return-to-work approver:

This worksheet is a coordination tool, not a place for passwords, recovery codes or full banking details. Reference a secure evidence location instead of copying sensitive material into every update.

6. Define a safe return to work

Agree on completion checks before re-enabling normal use. Ask IT to document restored account control, reviewed authentication methods, authorized rules and application access, and the remaining monitoring plan. Test ordinary sending and receiving with harmless messages through an agreed process.

The owner should separately confirm how staff will verify payment changes and how affected business conversations will resume. Keep unresolved questions visible: restoring access does not automatically establish what information was viewed or which recipients received fraudulent messages.

Close the incident record only after someone accepts the remaining actions and assigns dates. A useful follow-up improves the specific control that failed instead of simply telling everyone to be more careful.

Need help organizing your next steps? Contact Sosa Solutions NYC with the affected platform, the warning signs and a safe callback method. Do not include passwords, recovery codes or sensitive customer records in the initial inquiry.