Mailbox lockdown
Password reset, sessions revoked, and the attacker's rules, forwards, app grants, and sign-in methods removed after export.
The Problem
A Fake Invoice Went Out From Your Own Mailbox
It surfaces late: a supplier asks about new bank details, or a payment goes missing. By then the attacker may have read your mail for days.
Password only
One password reset leaves the attacker's forwarding rule running.
Password only
We remove rules, forwards, app grants, and sign-in methods, then revoke every session.
Hidden replies
Inbox rules push the real supplier's replies out of sight.
Hidden replies
Every mailbox in the tenant is swept for rules, not just the one you suspect.
No timeline
Nobody can tell the bank or insurer what happened.
No timeline
Audit logs become a dated timeline of sign-ins, reads, sends, and changes.
Next invoice
The next fake bank change arrives from another account.
Next invoice
Finance gets a call-back rule: any bank change is confirmed by phone first.
Your supplier calls about an overdue invoice you already paid. The new bank details came from an email that looked like theirs, inside a thread you recognize. Nobody knows who else got the same message, whether the attacker is still signed in, or whether a rule hides the real supplier's replies. Most teams reset one password and move on, while a forwarding rule keeps copying mail to an outside address. Without the audit trail, you can't tell your bank or insurer what happened.
We start with the money and the mailbox. You call your bank and file with the FBI's IC3 while we lock the account. The password changes, sessions are revoked, and the attacker's rules, forwards, app grants, and sign-in methods go. Then we read the audit logs and build a timeline of what was read, sent, and changed. You get a list of everyone who needs a warning. The fix covers the next attempt, not just this one.
Bank and IC3 first
We tell you to call your bank and report to IC3 before we touch anything.
Logs read, not guessed
Sign-in and mailbox audit logs show what the attacker actually read and sent.
Payment checks that hold
A call-back rule for every bank change, so the next fake request gets caught.
Our Business Email Compromise Response Process
From First Call to a Locked, Clean Mailbox in Five Steps
You see what we locked, what the logs show, and what to tell your bank and contacts. Nothing is deleted before it's exported.
We confirm what happened, which mailboxes and payments are involved, and who holds admin access. If money moved, you call your bank's fraud desk and file at ic3.gov while we set up access. You leave with the first containment steps.
What's Included
What You Get With a Business Email Compromise Investigation
Containment, a log-based timeline, a contact warning list, and controls that stop the same trick working twice. Everything is written for your bank, insurer, and counsel.
Compare Options
DeveloperLook vs Your IT Provider vs a Large Breach Firm
Your IT provider can reset a password fast, and a large breach firm brings insurer panels and legal reach. Here is where each one fits.
| Feature | DeveloperLookBest fit | IT provider | Breach firm |
|---|---|---|---|
| Time to start | Lockout on day 1 of work | Often fastest, already has access | Often waits for insurer approval |
| Rule and app sweep | Every mailbox, exported first | Often the victim mailbox only | |
| Audit log timeline | Included, in plain English | Rarely included | Included, very detailed |
| Contact warning list | Included, with wording | Not usually | |
| Payment-change controls | Call-back rule for finance | Not usually covered | Advice in the report |
| Insurer panel firm | Often yes | ||
| Support afterward | 30 days included | Ongoing contract | Per engagement |
| Cost predictability | Fixed price from $750 | Hourly, often the cheapest | Hourly or retainer, highest |
DeveloperLook
IT provider
- Time to start
- DeveloperLook: Lockout on day 1 of workIT provider: Often fastest, already has access
- Rule and app sweep
- DeveloperLook: Every mailbox, exported firstIT provider: Often the victim mailbox only
- Audit log timeline
- DeveloperLook: Included, in plain EnglishIT provider: Rarely included
- Contact warning list
- DeveloperLook: Included, with wordingIT provider: Not usually
- Payment-change controls
- DeveloperLook: Call-back rule for financeIT provider: Not usually covered
- Insurer panel firm
- DeveloperLook: IT provider:
- Support afterward
- DeveloperLook: 30 days includedIT provider: Ongoing contract
- Cost predictability
- DeveloperLook: Fixed price from $750IT provider: Hourly, often the cheapest
Projects We've Built
Finance and Insurance Websites We Have Built
Sites we built for advisers, investment firms, and insurers, where payment emails carry real money. These are builds, not fraud cases.
Armada AG Fiduciary and Consulting Services Website
- Finance
- Business
- Website
Envitis Investment Website Design & Development
- Finance
- Dashboard
- Website
EverTrust Insurance Web Design & Development
- Insurance
- Dashboard
- Website
Oasic Finance SaaS Web Design & Development
- Finance
- SaaS Platform
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built websites, apps, and platforms for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Finance and IT Teams Trust Us With BEC Response
BEC response is part log work and part calm. These habits keep evidence intact, money questions in the right hands, and your team told what is happening.
Money questions go to banks
We don't promise to recover wired funds, because only banks and law enforcement can attempt a recall. So we tell you to call your bank first.
Export before we delete
Every rogue rule, forward, and app grant is exported before removal. Your insurer and counsel may ask for that evidence later, and it can't be rebuilt once it's gone.
Updates in plain English
You get a short written update at each step: what we found, what we changed, and what's next. Nobody has to decode a log export.
Facts for counsel, not legal advice
Notification duties depend on your state, country, and contracts. We give your counsel the facts and let them make that call.
Temporary access only
We work from a temporary admin account and remove it at handover. Your audit log shows every change we made while inside.
Fixed price after triage
You get a fixed price once we know how many mailboxes are involved. If more turn up mid-investigation, we tell you before the scope changes.
Overview
How do you respond to business email compromise?
DeveloperLook handles business email compromise for companies on Microsoft 365 and Google Workspace. We lock the attacker out, remove hidden rules, forwarding, and app access, trace what was read and sent, and harden sign-in and payment checks. Response starts from $750, with lockout on day 1 and findings in 3 to 10 business days.
DEVELOPERLOOK
Project facts · Business Email Compromise Response
- Service
- Business email compromise response (lockout, log investigation, contact warnings, hardening)
- Typical timeline
- Lockout on day 1, findings in 3 to 10 business days
- Platforms
- Microsoft 365, Exchange Online, Google Workspace, and Gmail
- Built with
- Microsoft Purview Audit, Entra sign-in logs, Google Workspace audit logs
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of support after handover
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $750 USD, fixed scope after a free triage call
Reviewed 27 Oct 2026 by Saimul Islam
Good fit
Finance teams that paid a fake invoice
You paid a supplier invoice with new bank details, and the real supplier says they never changed accounts. You need the mailbox locked and the trail written down.
Companies whose mailbox sent the scam
Your customers received fake invoices from your real address. That's an email account compromise, and you need to know who was hit.
Small businesses without security staff
Your IT is one person or an outside provider, and nobody has run a mailbox investigation before. You want it done properly once.
Payroll teams hit by a deposit change
Your payroll team changed an employee's direct deposit after an email that looked like theirs. You want to know whether HR's mailbox is still exposed.
MSPs handling a client BEC attack
Your client is dealing with a business email compromise attack, and you need help with the log work under your name.
Not a fit
Getting wired money back
You want us to recover funds already sent. Only your bank and the FBI's IC3 can attempt a recall, so call your bank's fraud desk first.
Systems encrypted, not just email
Your files are encrypted and servers are down, not only a mailbox. Our ransomware recovery services fit that case better.
Staff training only
Nothing has happened yet and you want staff to spot fake invoices. Our phishing simulation service tests and coaches them instead.
Legal advice on notification
You need to know which regulators or customers the law says you must notify. That's a question for your counsel, and we give them the facts.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for Business Email Compromise Response
These are starting points in USD. Your final price depends on how many mailboxes the attacker touched and how much hardening you want, and you get a fixed proposal after a free triage call.
For Agencies
White-Label BEC Response for MSPs and IT Providers
You own the client relationship. We supply the BEC investigation: the log pulls, the rule sweep, and the timeline, written in your report format. Your client hears from you, and you keep a clean record of what was found and fixed.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the incident
Send the tenant, the affected mailboxes, and what the client has seen so far.
- Client needs
- You share the details
- Details received
We scope and price
You get a fixed price and a plan for the lockout and log work.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Investigate, then hand off
We lock, trace, and harden, then hand you the report under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the incident
Send the tenant, the affected mailboxes, and what the client has seen so far.
- Client needs
- You share the details
- Details received
We scope and price
You get a fixed price and a plan for the lockout and log work.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Investigate, then hand off
We lock, trace, and harden, then hand you the report under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
We work inside the email and identity tools you already pay for, using their own audit logs, so the evidence stays in your tenant.
- Microsoft Outlook
- Microsoft Exchange
- Gmail
- Google Workspace
- Microsoft Entra ID
- Okta
- 1Password
- Bitwarden
- Microsoft Purview Audit
- PowerShell
- Python
- VirusTotal
Cloudflare DNS- DMARC reports
- GoDaddy DNS
- Namecheap DNS
01 / 04
Related Services
BEC rarely stays in one inbox. These services cover the wider incident, the evidence, and the habits that stop the next attempt.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
Incident Response Services
DeveloperLook provides incident response services for small and midsize businesses: containment that keeps the evidence, root cause, cleanup, and staged recovery for servers, cloud accounts, and laptops. Cyber incident response with a fixed price after a free triage call.
Digital Forensics Services
DeveloperLook provides digital forensics services for businesses: evidence collected without changes, SHA-256 hashed copies, chain of custody, and a timeline of what happened on laptops, servers, and cloud accounts. Digital forensics consulting for HR, insurers, and counsel.This page
Business Email Compromise Response
Pairs with the 6 services around it
Email Security Services
DeveloperLook provides email security services for teams on Microsoft 365 and Google Workspace. We tune phishing and malware filters, block risky forwarding, enforce MFA, and give staff a report button. It's business email security set up once, then handed to your IT.
DMARC Setup Services
DeveloperLook provides DMARC setup services for businesses on Microsoft 365 and Google Workspace. We publish your DMARC record, read the reports to find every real sender, align SPF and DKIM for each one, and step the policy up to reject without blocking real mail.
Phishing Takedown Service
DeveloperLook runs a phishing takedown service for brands whose customers are sent to fake login or checkout pages: evidence captured, every fake site reported to its host, registrar, CDN, and browser blocklists, and new copies watched. Phishing site takedown without the guesswork.FAQ
Frequently Asked Questions
Straight answers on cost, timing, reporting, and how BEC fraud works and is stopped.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Business email compromise response starts at $750 for one compromised mailbox. That covers lockout, a rule and app check, an audit log timeline, and a contact warning list. Up to 10 mailboxes start at $1,950, and the $3,600 plan adds DMARC enforcement and a finance briefing. You get a fixed price after a free triage call.
The attacker is locked out on day 1 of the work, and most investigations finish in 3 to 10 business days. The pace depends on the number of mailboxes and how fast you grant admin access. DMARC enforcement on the top plan takes up to 6 weeks, because we watch reports before tightening the policy.
BEC (business email compromise) is fraud in which an attacker uses a hacked or spoofed business mailbox to get staff to send money or data. Common lures are a supplier bank change, a payroll deposit update, or an urgent request from a manager. The message often comes from a real account, so filters let it through.
It works by earning trust inside a real email thread, then changing where the money goes. The attacker steals a password or registers a lookalike domain, reads along, hides replies with rules, and sends a payment request at the right moment. A business email compromise scam can run for days before anyone notices.
Call your bank's fraud desk first and ask for a recall, then file a complaint at ic3.gov, as the FBI advises. Next, change the mailbox password and revoke its sessions, but export inbox rules and forwarding before deleting them. Then work out which contacts received fake messages and warn them by phone or a fresh email thread.
Report it to the FBI's Internet Crime Complaint Center at ic3.gov, whatever the amount, and tell your bank at the same time. Include the transaction details, the receiving account, and copies of the emails. Outside the US, also report to your national fraud reporting service. We prepare the timeline those reports ask for.
We investigate from audit logs, not guesses. In Microsoft 365 that means the unified audit log, mailbox audit records, and Entra sign-in logs; in Google Workspace, the Gmail and login audit logs. We line up the first suspicious sign-in, every rule created, and every message sent, then match them to the payments in question.
Yes, as long as the logs still exist. Microsoft 365 keeps standard audit records for 180 days, though some detail, such as which individual messages were opened, depends on your license. Google Workspace keeps its own log history. The sooner the investigation starts, the more of the trail is still there to read.
Prevent it with three layers: MFA, email authentication, and phone checks on bank changes. That means MFA on every account, SPF, DKIM, and DMARC at enforcement, and calling a number you already hold before paying new details. Business email compromise prevention is mostly process, because a well-made fake can still pass filters.
Partly. Most cases start with a phishing email that steals a password. The fraud that follows is targeted: one company, one payment, and often no link or attachment. That's why business email compromise protection leans on payment checks and sign-in alerts as much as on spam filtering.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.