Business Email Compromise (BEC) in Microsoft 365: How Attacks Actually Work

What BEC Looks Like in the Wild (Microsoft 365 Edition)

Business email compromise is not always “a hacker in Nigeria.”

It is often:

• a vendor mailbox you trust, already compromised upstream
• an executive display name spoof with a look-alike domain
• an internal mailbox taken over via reused passwords or device theft
• subtle inbox rules forwarding invoices to an attacker-controlled folder

The common thread: the email reads boring and plausible because it is built from real threads.

Microsoft 365 Controls That Actually Change Outcomes

Identity and MFA

Stolen passwords are still the fast lane. Enforce strong MFA and reduce bypass paths—see Microsoft 365 MFA: what to require.

Phishing-resistant posture and user training

Attackers train too—usually on your org chart. Pair technical controls with security awareness that includes AP-specific scenarios.

Mail flow hygiene

DMARC/DKIM/SPF, anti-spoofing policies, and safer link handling reduce look-alike success rates—but do not replace call-back verification for new banking instructions.

Detecting silent persistence

Review risky inbox rules, forwarding, and unusual OAuth grants—BEC often “lives quietly” for days before the big ask.

Real-World Example

AP received a “vendor portal update” email that matched tone and signature.

The bank account on the PDF changed by two digits. The amount and vendor name were perfect.

Finance caught it only because a call-back rule required voice confirmation for any change to wire instructions—MFA on the mailbox did nothing because the user clicked a link and typed their password willingly.

How to Connect This to Services

• Phishing defense and Microsoft 365 security should map to the mailboxes that move money.
• Email security in Microsoft 365 belongs in the same conversation as finance policy—not “IT extras.”

For a shorter BEC narrative written for security readers, see business email compromise in the cybersecurity series.

Final Thoughts

BEC wins when speed beats verification.

Slow down the moments that matter—new vendors, changed bank details, “urgent” CEO requests—and give IT visibility into the mail patterns finance already knows are weird.

That combination is what turns Microsoft 365 from the attack surface into the place you catch the story before the wire leaves.