Business Email Compromise Checklist: Contain and Preserve in Parallel

Global Digital Forensics checklist. Edition 2026-11-03, November 3, 2026. 24/7 hotline (800) 868-8189.

A diverted payment starts three clocks at once: the bank recall window, the tenant log retention window and the insurer’s notice period. This checklist assigns the bank call, the account containment and the evidence capture to named people who work at the same time, so nobody waits for an export to finish before acting.

Why the First Hours Decide Both the Recall and the Record

As soon as a payment looks diverted, the person who released it calls the sending bank’s fraud desk with the reference number, the beneficiary account and the amount, and asks for a recall and a freeze at the receiving institution. At the same time the security lead blocks the intruder’s continuing access. Finance keeps the approval emails, the vendor record change and the fraudulent messages intact, because each one answers a question the bank and the insurer will ask.

The record matters because a diverted wire produces two disputes. The first is between your company and its own bank, where the question under UCC Article 4A is whether the payment order was accepted under a commercially reasonable security procedure. The second is between you and the counterparty, where the allocation of loss turns on whose tenant was compromised and who missed the warning signs. Both are answered from logs that expire on schedules nobody in finance set. Microsoft Entra sign in logs are kept for 7 or 30 days depending on the license, and the Purview audit log keeps 180 days of records under Audit (Standard).

The Order of Operations, From the Bank Call to the Hash Log

The sequence starts with money, because the recall window is the shortest clock in the building. The treasurer or controller calls the bank, then files a complaint with the FBI Internet Crime Complaint Center at ic3.gov with counsel and keeps a copy of exactly what was filed. Finance preserves the payment approval chain, the vendor master change and the call log that shows whether anyone confirmed the new instructions by phone.

Containment and preservation run together. Authorized administrators block sign in, revoke sessions, reset credentials and remove malicious inbox rules, forwarding, delegates and application grants. Where time allows, they capture the current configuration first. The sign in and audit history is exported separately for the tenant, the accounts and the period involved, with the query, the time zone and the export receipt. Rule creation, change and removal events in the audit log are a different record from the rules that exist today, and both are kept. Original fraudulent messages are preserved as native.eml or.msg files with their transport headers. Each captured file is hashed and the algorithm, the object and the result are recorded. Every containment step is logged with who did it, when, on whose authority and what changed.

Who Acts, and Who Keeps Their Hands Off the Mailbox

Counsel directs legal notices, the preservation scope and the communications that follow. Finance owns the bank and IC3 escalation. The security lead owns containment and coordinates the configuration, message and log capture with the administrators and the examiner. The preservation instruction allows necessary protection, provided every change is written down, rather than freezing the tenant in a state that leaves the intruder inside.

Everyone else stays out of the mailbox. Casual browsing and cleanup by well meaning staff create new events that later have to be separated from the intruder’s. Forwarding a suspicious message to the help desk produces a copy without its original headers; attach the native file instead, or leave it where it is for collection.

The Cleanup Habits That Erase the Proof

Deleting a malicious rule without capturing it first removes the clearest picture of its target and conditions. The audit events for its creation may survive, but only until the retention window closes. Exporting a single mailbox is the other common mistake. A compromise that began weeks before the fraudulent instruction may have touched more accounts than the one that sent the payment request, so the export covers every account the intruder’s sessions reached and expands as the analysis finds more.

The counterparty’s logs are half the evidence when the dispute turns on whose mailbox was compromised. Counsel sends the preservation request to the counterparty while those records still exist.

How GDF Supports Counsel, Finance and Security Teams

Global Digital Forensics has collected thousands of mailboxes and analyzed hundreds of compromised accounts for counsel, insurers and corporate security teams, and has done this work since 1992. We work alongside your administrators to capture the records described here in a documented form, then analyze the headers, authentication results, rule history and sign in records to separate three findings: that a fraudulent message arrived, that your tenant was accessed, and whether the two are connected. Each finding is tied to its own evidence in the report.

Counsel receives a timeline with every event tied to its source record and, where needed, a declaration from the examiner who did the work. Finance receives the technical facts the IC3 complaint and the insurer’s questionnaire ask for. Our examiners have testified in federal and state courts. The initial consultation is free, and the first call usually happens while the treasury team is still on the phone with the bank. Call (800) 868-8189 at any hour.

Capture, action and verification record

For each source, write down the tenant and account, the source type, the period requested, the earliest and latest records returned, the permissions used, the method, the query and the export receipt, and give it an evidence ID. Keep the current configuration and the audit history in separate rows. When a source comes back empty or blocked, record that and the follow up, so the coverage record stays complete.

For each containment action, record an ID, the authority, the operator, the time and time zone, the reason, the settings changed and the result you observed. Link screenshots and exports by evidence ID, verify hashes whenever files move, and keep failed exports. Passwords, keys and the evidence itself belong in the approved secure repository.

The Checklist at a Glance

The same rows are in business_email_compromise_checklist_workbook.csv, with columns for the owner, the date, notes, status, the evidence ID and the next action.

Sources