Business Email Compromise Checklist: Preserve Before You Clean Up

Why the First Hours Decide Both the Recall and the Record

A misdirected payment is discovered the same way almost every time. A vendor calls to ask where the money is, accounts payable pulls up the thread, and someone notices that the account change instructions came from an address one letter off from the real one. The funds are still moving through the beneficiary bank and onward, and the recall request gets weaker with every hour. The technical record that shows which mailbox was under someone else's control is also at risk, because the first instinct of a capable administrator is to delete the rule, reset the password and purge the messages, which destroys the very evidence the bank, the insurer and opposing counsel will demand.

The reason the record matters is that a diverted wire produces two disputes at once. The first is between your company and its own bank, where the question under UCC Article 4A is whether the payment order was accepted under a commercially reasonable security procedure. The second is between you and the counterparty, where comparative fault turns on whose tenant was compromised and who missed the warning signs. Both questions are answered from logs that expire on schedules nobody in finance or legal set. Microsoft Entra sign in logs are retained for seven or thirty days depending on license, and the Purview unified audit log keeps 180 days under standard licensing. Our guide to the first 24 hours of a business email compromise explains the three parallel tracks. This checklist is the preservation track, written so you can run it tonight.

The Order of Operations, From the Bank Call to the Hash Log

The sequence starts with money, not evidence, because the recall window is the shortest clock in the building. The treasurer or controller who released the payment calls the sending bank's fraud desk with the reference number, the beneficiary account and the amount and asks for a recall and a freeze at the receiving institution. The same person, with counsel, files a complaint with the FBI Internet Crime Complaint Center so the Bureau can coordinate with the banks, and keeps a copy of exactly what was filed. While those calls are happening, the finance team stops deleting anything. The payment approval emails, the vendor master change record, the call log showing whether anyone verified the new instructions by phone, and the original fraudulent messages are all part of the record, and each one answers a question the bank and the insurer will ask.

Preservation of the tenant follows, and the order inside it matters. Before any rule is removed or any password reset, the administrator exports the inventory of inbox rules, forwarding addresses, delegate permissions and transport rules for every affected mailbox, because deleting a rule deletes the record of its creation and its target. Next come the Entra sign in logs, which expire first. Then the Purview unified audit log for the affected users, including inbox rule creation events and MailItemsAccessed records that show which folders the intruder's session synchronized. The original fraudulent messages are saved from the mailbox as .eml or .msg files, never forwarded, so the Received chain and the authentication results survive. Every export is hashed and logged with the time and the person who ran it. Only then do containment steps begin: revoke sessions, reset credentials, remove the rules, and record each action with a timestamp.

Who Acts, and Who Keeps Their Hands Off the Mailbox

Counsel directs from the first call. Outside or general counsel decides who notifies the counterparty, what is said to the bank in writing, when the insurer receives notice and how the examiner is engaged so the analysis runs under the direction of counsel. Counsel also sends two short holds the same day: one to internal IT freezing any change to the affected mailboxes, rules, sign in logs and audit configuration, and one to the counterparty asking it to preserve its own tenant logs and original messages. Finance owns the bank and IC3 track. The Global Administrator or Exchange administrator owns the exports, working from a written list rather than memory, and the security team owns the containment steps once the exports are complete and verified.

The people who must not act are the ones most tempted to. Nobody signs in to the compromised mailbox to read what the intruder saw, because every message opened acquires a new access record attributed to the company and muddies the MailItemsAccessed trail. Nobody forwards the fraudulent email to the examiner or to counsel as a convenience, because forwarding rewrites the headers that show the true route. And nobody tells the bank or the insurer that the company's systems were or were not compromised until the record supports the statement, because that representation will be compared against the forensic account later. Our wire fraud attribution guide explains how comparative fault is argued from exactly these records.

The Cleanup Habits That Erase the Proof

The most common loss is the deleted rule. A hidden inbox rule that moved the vendor's replies to an obscure folder is the clearest evidence that your tenant, and not only the counterparty's, was accessed, and an administrator who deletes it before exporting it has removed the creation timestamp, the creating session and the target folder in one click. The second is the forwarded email. A fraudulent message forwarded to a shared inbox carries the forwarder's headers, not the attacker's, and the lookalike domain or failed DMARC result that would have settled the question is gone from the copy. You can see what original headers contain with our Email Header Analyzer, which processes nothing on our servers.

Two quieter mistakes do as much harm. The first is treating the counterparty's logs as someone else's problem. If the comparative fault argument turns on whose mailbox was compromised, the counterparty's sign in and rule records are half of the evidence, and the preservation request has to go out while they still exist. The second is scope. A compromise that began weeks before the fraudulent instruction may have touched more mailboxes than the one that sent the payment request, and an export limited to a single user leaves the rest of the tenant unexamined while its logs age out. Under the direction of counsel, we recommend exporting sign in and audit records for every account the intruder's session touched, and expanding from there as the analysis identifies further sessions.

How GDF Supports Counsel, Finance and Security Through the Analysis

Global Digital Forensics has analyzed hundreds of compromised accounts and collected thousands of mailboxes for counsel, insurers and corporate security teams since 1992. In a business email compromise we work alongside your administrators to capture the exports described above in a forensically sound and documented form, then analyze the headers, the authentication results, the inbox rule history and the sign in records to separate three propositions: that a fraudulent message arrived, that your tenant was accessed, and that the two are connected. Each proposition gets its own evidence in the report, so counsel can see which one the record actually reaches and argue the allocation of loss without asserting a tenant compromise the logs do not support. Our business email compromise analysis and Microsoft 365 forensics pages describe the sources this draws on.

The deliverable is written for the people who lead the underlying inquiry. Counsel receives a timeline with each event tied to its source record and its clock, a statement of what the record establishes and where it stops, and, where needed, a declaration from the examiner who did the work. Finance receives the technical facts the IC3 complaint and the insurer's questionnaire ask for, in the same words used everywhere else. Our examiners have testified in federal and state courts, and the examiner who runs the analysis is the one who explains it. The first call is free, and it usually happens while the treasury team is still on the phone with the bank. Call (800) 868-8189 at any hour.

The Checklist at a Glance

Request the Formatted Checklist

The formatted checklist and workbook edition of this page, laid out as a printable control sheet with space to record who ran each export, when and with what hash, is delivered by a private email link through the request form. Give us your name and email, and the link opens the preparation library downloads in your browser. If the wire is already gone and the mailbox is still live, do not wait for the download. Call (800) 868-8189 at any hour and a senior examiner will walk your administrator through the exports on the spot. The initial consultation is free.