How to tell if a BEC attack was caught automatically or by a human
Security controls often fail to flag Business Email Compromise cases because attackers lurk silently in mailboxes for weeks without triggering outbound spam alerts. This leaves security teams unable to determine whether automated defenses or manual human review actually caught the breach.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1relying on IAM suspicious sign-in reports
- 2checking outbound anti-spam rules after bulk sends
- 3using powershell to audit forwarding rules after user complaints
- 4Searching audit logs using PowerShell or Purview for MailItemsAccessed events
- 5Manually inspecting inbox rules, hidden rules, and forwarding addresses
- 6Checking OAuth app consents under enterprise applications
In their words
Unedited, most upvoted first, each linked to the thread it came from.
“I caught one last year where someone was sitting in a mailbox for like six weeks just reading everything and setting up rules to hide replies from vendors. no outbound spam or anything just silently gathering contract details”source ↗
“We had the dumbest person person get access right after sign in check. Sat there for a week and had access to literal gold mine of stuff.”source ↗
“when you've dealt with BEC case, did email auth flagged it, or did it look totally normal and only a human caught it?”source ↗
Where this came up
People with this problem also raised
- 6Getting weird scam letters or emails from banks I don't use
- 4Why does IT send fake phishing emails that stress us out?
- 2Automated notification emails only show IDs instead of client names
- 3How to stop an email spam bomb attacking a user inbox
- 2Why do self-hosted emails keep going to spam?
- 2Bank refuses to close fraudulent business account opened with my EIN