Business email compromise is the most common — and most expensive — attack on small businesses. If you are reading this mid-incident: work this list top to bottom, in order. The order matters more than speed.
Minutes 0–15: lock the door
1. Change the password from a device you trust — not the possibly-compromised one. Make it long and new, not a variation of the old one.
2. Kill every active session. In Microsoft 365 or Google Workspace, an admin can sign the account out everywhere at once. This matters because attackers keep working inside already-open sessions after a password change.
3. Turn on MFA if it was not on. If it was on and they still got in, assume they phished a login token — killing sessions handles that, but tell whoever manages your IT immediately.
Minutes 15–30: find what they left behind
Attackers rarely just read email — they set up persistence. Check forwarding rules first: the classic move is a rule quietly copying every incoming invoice or bank email to an outside address. Then check inbox rules (auto-delete rules that hide the replies to fraud emails they send), connected apps, and mailbox delegates you do not recognize. Delete all of it and screenshot as you go — you may need evidence.
Minutes 30–60: contain the blast radius
Ask the compromised account's owner what the attacker could have seen: wire instructions, customer data, password reset emails for other systems. Reset anything that email account could reset. If money moved or was requested — a changed invoice, new "vendor" banking details — call your bank's fraud line immediately; recalls are time-critical, measured in hours.
Then warn your contacts. It is embarrassing for ten minutes and it prevents the attacker from using your name to phish your customers, which is far worse.
After the fire: make it not happen again
One compromised mailbox is a symptom. The fix is boring and effective: enforced MFA for every user, modern email filtering, endpoint detection, and someone actually watching alerts. That is precisely the security layer in our Professional managed IT plan — and if you just want the cleanup done right, our $89/hour IT support covers incident response without a contract.
Mid-incident and out of your depth? Call us — email compromise cleanup is one of the most common jobs we do, and an engineer answers the phone.