A compromised business email account can put more than one person’s inbox at risk. An attacker may use a trusted address to send convincing messages, change payment instructions, or try to access other business services. Acting quickly can help limit the damage.
This guide explains signs employees may notice, what to do first, and how to restore control while checking for activity that could continue after a password change. If you suspect an account takeover, report it to your IT support or email administrator promptly rather than waiting for every detail to be confirmed.
Signs a business email account may be compromised
One clue alone does not prove that an account has been taken over. But unexpected changes or several unusual events together deserve attention.
- Unfamiliar sign-in alerts: The employee receives notifications about a sign-in, password reset, or authentication request they did not initiate.
- Messages the employee did not send: Coworkers or customers report unusual emails from the account, especially requests to share information, open a file, or change payment details.
- Missing or altered email: Expected messages disappear, replies are missing, or conversations seem to have been moved or deleted.
- Unexpected account changes: The password no longer works, recovery details have changed, or the employee is prompted to approve an unfamiliar authentication method.
- Unusual forwarding or mailbox behavior: Messages appear to be forwarded, redirected, or sorted into folders the employee did not set up.
Employees can flag these clues, but an administrator may need to review sign-in records, active sessions, mailbox rules, forwarding settings, and authentication methods. Logging can help establish what happened and when. The CISA guidance on using business system logs explains why keeping and reviewing those records matters.
Respond in order: contain, recover, investigate
Report the concern and limit exposure
Tell your IT team, email administrator, or managed IT provider using a communication channel that is not the suspected mailbox. If your organization has an incident-response process, follow it. Share what you observed, when it began, and whether any customers, coworkers, or payment requests may be involved. Avoid deleting suspicious messages or resetting settings before the team can preserve useful evidence, unless immediate action is needed to stop ongoing harm.
If there is clear evidence of active misuse and the employee cannot regain control safely, an administrator may temporarily block sign-in or disable the account while investigating. This can interrupt the employee’s access, so coordinate the step with IT whenever possible. If the account is still accessible and IT can guide the recovery, secure it promptly rather than leaving it open.
Secure access from a trusted device
Use a device you believe is safe, and reach the email service through its known sign-in route rather than a link in an unexpected message. Change the password to a new, unique one. If the same or a similar password was used elsewhere, change it for those accounts too, starting with accounts that can reset other passwords.
A password change alone may not end an attacker’s access. Ask the administrator to revoke active sessions and sign out devices that should no longer be trusted. Review recovery email addresses and phone numbers, authentication methods, and any app passwords. Remove changes the employee did not make, then set up the organization’s approved multifactor authentication method again if needed.
Microsoft’s response guidance for a compromised Microsoft 365 email account covers administrator actions such as restricting access, reviewing account settings, and checking for suspicious activity. The exact controls depend on your email service and organization’s setup.
Look for changes that could keep the attacker connected
Once access is secured, IT should check the mailbox and the account’s connected services for unauthorized changes. Review:
- Forwarding addresses, inbox rules, filters, delegates, and mailbox permissions.
- Sent, deleted, and archived messages for unexpected activity.
- Sign-in records, active sessions, unfamiliar devices, and authentication changes.
- Connected applications or permissions that the employee or administrator does not recognize.
- Other business accounts that use this email address for sign-in or password recovery.
Remove unauthorized rules, forwarding, permissions, or connected applications. Then check whether the account was used to access file storage, collaboration tools, customer systems, or other services. If those services share credentials or rely on the email account for recovery, secure them as well. Keep relevant messages and logs according to your organization’s incident process.
Tell affected coworkers and customers
If the account sent suspicious messages, identify who received them and what action the message asked them to take. Notify affected people through a separate, trusted channel. Keep the warning brief: explain that a message from the account was not authorized, ask recipients not to follow its links or instructions, and provide a safe way to verify any request.
For payment or account-change requests, remind recipients to confirm the request using a phone number or contact method they already trust, not the details in the questionable email. If sensitive information may have been exposed, coordinate communications with the appropriate internal leaders and advisors. For organizations handling sensitive communications, Zevonix’s guide to safer patient communication options may help inform broader communication practices.
A compromised legitimate mailbox is different from a spoofed sender address. In an account takeover, someone may have access to the real mailbox. In spoofing, a message may be made to look as if it came from an address without the sender signing in to that account. Either can lead to fraudulent requests, so do not assume the account is safe solely because the employee can still sign in. IT can examine message details and sign-in activity to help distinguish the situations. For more background, see Zevonix’s explanation of email address lookalikes and hijacking risks.
If the email led to a payment or changed bank details
Treat suspected payment fraud as urgent and separate from the email recovery work. Contact your bank immediately using a verified phone number, explain that a transfer or payment may be fraudulent, and ask what steps are available to stop, recall, or reverse it. Preserve the related emails, payment instructions, and records of communications. Do not rely on contact information supplied in the suspicious message.
Report suspected business email compromise to the appropriate authorities. The FBI’s IC3 Business Email Compromise guidance provides reporting information. Your organization’s IT and leadership teams can coordinate the incident response and determine what other notifications may be appropriate.
When to escalate
Contact your email provider or IT support if you cannot sign in, cannot remove unfamiliar settings, see unexplained access, or suspect that other services were reached through the account. Escalate promptly if the mailbox contacted customers, requested payment, exposed sensitive information, or appears to be part of a wider compromise. If money may have moved, contact the bank immediately as well. Preserve evidence and use trusted communication channels throughout the response.
For help assessing a business email security incident and coordinating recovery, contact Zevonix. A clear response plan can help your team regain control and reduce the chance of the incident spreading.
Frequently asked questions
Should we change the password or disable the account first?
If the employee can access the account safely and IT can guide the recovery, change the password promptly and revoke active sessions. If the attacker appears to be actively using the mailbox or the employee cannot secure it, an administrator may block sign-in temporarily while investigating.
How do I check for forwarding rules or changed recovery details?
Review the mailbox’s forwarding settings, rules, delegates, recovery information, and authentication methods. An administrator should also check sign-in records and connected applications, since some changes may not be obvious to the mailbox user.
How can we sign out an attacker who may still have a session?
Ask your email administrator to revoke active sessions or sign out all sessions through the service’s account controls. Then secure the password and authentication methods. A password change by itself may not end every existing session.
How can we tell whether the sender address was spoofed instead?
Do not rely on the visible sender name alone. IT can review message details and account sign-in records to determine whether the real mailbox was accessed or the address was only imitated. In either case, warn recipients not to follow suspicious instructions.
Take the next step
A suspected account takeover calls for a coordinated response: report it, contain access, restore control, check for hidden changes, and protect anyone who may have received fraudulent messages. If you need support assessing the situation, reach out to Zevonix through its contact page.
Stay Informed
Want smarter insights without the noise? Get our latest ideas and strategies delivered right to your inbox.
We respect your privacy. Unsubscribe at any time.