Cloud and email evidence

Cloud and Email Evidence After a Wire Fraud

A diverted wire or a hijacked mailbox leaves its record in cloud logs that expire on the provider's schedule, not yours. These guides explain what to preserve, in what order, and how the record decides who bears the loss.

Get a free consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

The Decision Counsel Faces When a Payment Goes to the Wrong Account

The call usually comes from finance or from the general counsel. A vendor payment or a closing wire went to an account nobody recognizes, the bank has been asked for a recall, and somebody has already reset the password on the mailbox that carried the fraudulent instruction. In that moment counsel has to decide three things at once: how to contain the account without destroying the record, which cloud logs to export before the provider's retention window closes, and how to keep the technical work under counsel's direction so the insurer, the counterparty and any court can later see a disciplined record. The guides in this topic were written for that moment, and they share one premise. The tenant logs, the mailbox rules and the original messages with full headers are the evidence, and most of it expires on a schedule the platform publishes rather than on one the client chooses.

The same evidence decides disputes that outlast the incident. Whose system was compromised, the sender's or the recipient's, often decides who bears the loss on a diverted wire. Whether multi factor authentication was in place and whether a payment verification procedure was followed shapes the insurance claim. Whether the attacker read a particular mailbox or exported a particular folder determines which notification duties attach. Each of those questions is answered from identity records, audit logs and message headers, read together and tied to the business timeline from finance. That is the discipline GDF has applied across hundreds of compromised account analyses and thousands of collected mailboxes, and it is why every guide here spends as much time on what the record cannot show as on what it can.

How to Read These Guides and in What Order

Start with the guide that matches the hour you are in. If the loss was discovered today, read the first 24 hours guide, which coordinates the bank recall, the identity containment and the forensic preservation so none of the three undoes the others. If the account was protected by multi factor authentication and was compromised anyway, the session token theft guide explains why a password reset does not end the intrusion and which Entra, Purview and Workspace records to export first. When the dispute has moved to who bears the loss, the wire transfer attribution guide walks through reading both parties' email environments to establish where the thread was hijacked.

The middle of the sequence turns from the single mailbox to the enterprise. The cloud source map guide is for counsel and security leaders whose evidence is spread across several tenants, acquired subsidiaries and former administrators, and the Teams, Slack and email reconciliation guide addresses the discovery gaps that open when workplace chat is treated like email. The preservation mistakes guide closes that group with the handoff points where enterprises most often lose evidence. The four legacy publications that finish the topic, on bank employee targeting, long dwell intrusions, trusted vendor compromise and executive social engineering, explain how the schemes are built, which is the context that makes the technical record legible.

What GDF Does for Counsel, Auditors and Security Teams

Global Digital Forensics has examined compromised business mailboxes since 1992, first on mail servers in the client's own data center and now in Microsoft 365 and Google Workspace tenants. The firm's email practice has collected thousands of mailboxes, completed hundreds of compromised account analyses and supported hundreds of email related depositions and testimony engagements. The work runs under the direction of counsel. We preserve tenant audit and sign in logs, mailbox rules, OAuth consents and the original messages with full headers, we correlate them with the payment approval trail, and we write a report that states what the record establishes, where it falls silent and why. Our examiners have testified in federal and state courts, and the firm serves AmLaw 100 firms, Fortune 1000 companies and the small and midsize businesses that wire fraud schemes also reach.

The services behind these guides are business email compromise analysis, Microsoft 365 email forensics, Google Workspace email forensics and cloud and SaaS forensics, with cloud eDiscovery collections when the matter moves into litigation and the collection has to feed a review platform. GDF developed its own collection and review processing tools, including eCloud Discovery, so a tenant export can move from preservation to review without a second vendor handling the data. For internal auditors and security teams the same examination answers a different question, whether the controls represented to the board, the carrier or the regulator were in fact operating on the day of the compromise, and the report is written so an auditor can trace each conclusion to the log entry that supports it.

How to Begin

The initial consultation is free, and the hotline at (800) 868-8189 is answered around the clock from sixteen US offices. On the first call a senior examiner asks for the affected mailbox addresses, the original fraudulent messages as .eml or .msg files rather than forwards, the approximate date range of the payment conversation, the tenant license tier, a Global Administrator contact and a list of any changes already made to rules, passwords or sessions. From those facts we tell you which records are at risk of rolling off first, what to export tonight and what can wait for a formal scope, and we say plainly whether the matter needs a short attribution memo for the insurer or a declaration prepared for litigation.

Before the call, two resources on this site save time. The email header analyzer lets counsel or IT read the routing path of a suspicious message without altering it, and the common digital evidence mistakes guide lists the containment steps that quietly destroy the record. Neither replaces an examination, and both make the first conversation more productive. If the matter is already in dispute, bring the payment approval trail from finance and any correspondence with the bank, because the technical timeline is most useful when it can be tied to the business decisions it explains. You can also request a consultation online and an examiner will call back.

Read in this order

The Guides in This Topic

Guide
Business Email Compromise First 24 Hours: How Legal, Finance and Security Leaders Coordinate Evidence and Recovery
For legal, finance and security leaders on the day a wire fraud is discovered, settling how recall, containment and preservation run together without destroying evidence.
Guide
Suspected Cloud Session Token Theft: How General Counsel and CISOs Must Preserve Microsoft 365 and Google Workspace Evidence
For general counsel and CISOs whose protected account was compromised anyway, settling why a password reset fails and which identity logs to export first.
Wire fraud attribution
Defending Against Multi Million Dollar Wire Transfer Fraud: Forensic Attribution in Vendor and Real Estate Payment Disputes
For counsel and insurers in a disputed wire transfer, settling how both parties' email environments are read to establish where the payment thread was hijacked.
Guide
Mapping Cloud Evidence Across Multi Tenant Environments and Acquired Businesses Before Collection Begins
For counsel and security leaders with evidence spread across tenants and acquired businesses, settling how a cloud source map is built before collection begins.
Guide
Reconciling Microsoft Teams, Slack and Email Collections: How Litigators Prevent Discovery Gaps Before Review
For litigators collecting workplace chat alongside email, settling how message versions, channel membership and linked files are reconciled to prevent discovery gaps.
Guide
Preventing Evidence Loss at Enterprise Handoffs: How Legal and IT Teams Stop Spoliation During Employee Departures
For legal and IT teams managing departures and device returns, settling where enterprises most often destroy evidence and how preservation gates prevent it.
Financial services security
Financial Institution Identity Attacks: How Adversaries Target Bank and Fintech Employees to Bypass Perimeter Controls
For banks, credit unions and fintech security teams, settling why one compromised employee identity beats the firewall and how the identity record is read afterward.
Compromise assessments
Detecting Long Dwell Financial Intrusions: How Threat Actors Lurk Inside Corporate Networks Before Striking
For security leaders worried about an intruder already inside, settling how a compromise assessment finds long dwell activity before the fraud or ransomware strikes.
Supply chain security
Third Party Vendor and Supply Chain Compromise: Auditing Trusted Network Connections and B2B Email Threads
For enterprises whose breach began at a vendor or managed service provider, settling whose logs tell the story and what to demand from the supplier.
Social engineering defense
Executive Social Engineering, Voice Cloning and Helpdesk Impersonation: Hardening Human Verification Workflows
For helpdesk, finance and executive staff facing voice cloning and impersonation, settling how verification workflows are hardened and what a voice clone leaves behind.

Frequently asked

Questions Readers Ask in This Topic

What evidence should be preserved after a business email compromise?

Preserve the tenant sign in and audit logs for the affected accounts, the mailbox rules and OAuth application consents, the original messages with full headers saved as .eml or .msg files, and the payment approval trail from finance. Export or screenshot rules and consents before removing them, and revoke sessions rather than only resetting the password. Microsoft and Google publish retention windows for these logs, so the export should happen before containment changes the record.

Who is liable when a wire transfer is sent to a fraudulent account?

That is a legal question that turns on the contract, the jurisdiction and the facts, and courts have looked closely at which party's email environment was compromised and whether reasonable verification procedures were followed. A forensic examination supplies those facts by reading the sign in records, mailbox rules and message headers on both sides of the thread under the direction of counsel. The report states where the thread was hijacked and what each party's record shows.

Can a stolen session token bypass multi factor authentication?

Yes. When an attacker captures a valid session cookie or refresh token through a phishing proxy or an infostealer, the service treats the session as already authenticated and no second factor is requested. Resetting the password does not end the session. Containment requires revoking all sessions and tokens and removing added authenticators and application consents, and the identity logs record the token reuse in ways an examiner can read if they are preserved in time.

Talk with an examiner

Bring the Question to an Examiner Who Has Testified

If your matter sits inside cloud and email evidence after a wire fraud, call and describe it in plain words. A senior examiner will tell you which guide applies and what the first step is. The initial consultation is free.

Call (800) 868-8189 Get a free consultation

24/7 hotline: (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed October 31, 2026.