Business email compromise is one of the fastest-growing cyber threats — and one of the hardest to detect. Unlike ransomware, which announces itself loudly, email compromise is designed to be invisible. An attacker gets into your email, quietly watches, and waits for the right moment to strike.

The good news is that there are warning signs. If you know what to look for, you can catch a compromised account before it becomes a full-blown crisis.

What Business Email Compromise Looks Like

Business email compromise (BEC) happens when an attacker gains access to a legitimate business email account — usually through stolen credentials or a phishing attack. Once inside, they don’t immediately do anything dramatic. Instead, they observe.

They read your emails. They learn who you do business with. They study how you communicate, how invoices are sent, and who has authority to approve payments. Then they act — impersonating you or your employee to redirect a payment, steal sensitive data, or launch further attacks.

Warning Signs Your Email May Be Compromised

1. Unexpected Password Reset Emails

If you’re receiving password reset notifications you didn’t request — for your email, cloud storage, banking, or any other service — someone may be trying to take over your accounts. Don’t ignore these. Change your password immediately and enable multi-factor authentication.

2. Emails in Your Sent Folder You Didn’t Write

If you see sent messages you don’t recognize, an attacker may be using your account to send phishing emails, fake invoices, or requests to your contacts. Check your sent folder regularly — and ask your team to do the same.

3. Missing Emails or Strange Inbox Rules

Attackers often create mail rules to automatically forward, delete, or move messages so you won’t see them. If emails you’re expecting aren’t arriving, or if you notice inbox rules you didn’t create, that’s a strong indicator of compromise.

Check your email rules regularly. In most email platforms, you can find these under Settings > Rules or Filters.

4. Login Alerts from Unusual Locations

Many email services will notify you of logins from new devices or locations. If you see a login from a city or country you’ve never been to, take it seriously. Even if it turns out to be a VPN or travel-related, investigate immediately.

5. Contacts Telling You Something’s Off

Sometimes the first sign of compromise comes from outside your organization. If a client or vendor contacts you about a suspicious email they received from your address — or about payment instructions that don’t match — treat it as a potential breach and investigate right away.

6. Sudden MFA Prompts You Didn’t Trigger

If you’re getting multi-factor authentication prompts when you haven’t tried to log in, someone is entering your password and hitting the MFA wall. This means your credentials are compromised — the MFA is doing its job, but you need to change your password immediately.

What to Do If You Suspect a Compromise

If any of these warning signs show up, act quickly:

• Change the password immediately — use a strong, unique password that hasn’t been used anywhere else
• Enable or verify MFA on the affected account and any related accounts
• Check email rules and forwarding settings — remove anything you didn’t create
• Review recent sent emails for unauthorized messages
• Alert your team and contacts — let anyone who may have received suspicious messages know not to act on them
• Contact your IT provider so they can investigate the extent of the compromise and secure your systems

Prevention Is Always Cheaper Than Cleanup

The best defense against business email compromise is a layered approach:

• Multi-factor authentication on every business email account — no exceptions
• Email security filtering that catches phishing attempts before they reach inboxes
• Dark web monitoring to detect stolen credentials early
• Regular security awareness training so employees can recognize phishing attempts
• Automatic account lockdown when suspicious login behavior is detected

The Takeaway

Email compromise is silent, patient, and expensive. But it’s not unstoppable. By knowing the warning signs and having the right protections in place, you can catch a compromise early — or prevent it entirely.

Think your business email might be at risk? Contact us for a security review — we’ll help you find and close the gaps.