Most cyber incidents don’t start with alarms going off. They usually begin with an email that looks completely normal.
A supplier updates their bank details. A CEO asks for an urgent transfer. A colleague shares a file. It all seems routine, so it doesn’t raise any immediate concerns.
This is what’s known as Business Email Compromise (BEC). It’s a common type of scam where attackers use email to trick people into sending money or sharing information. In Australia, it’s a growing issue – scammers stole more than $152.6 million through BEC attacks in 2024, and it currently ranks among the top three self-reported cybercrimes for businesses.
If your business uses Microsoft 365, it’s worth understanding how these scams work and what you can do to reduce the risk.
The good news is, with the right Microsoft 365 security setup and ongoing management, you can significantly reduce your risk and stay one step ahead of these attacks.
What is Business Email Compromise (BEC)?
Business Email Compromise is a type of attack where someone gains access to, or convincingly impersonates, a trusted email account. The goal is usually to get someone to send money, share sensitive information, or approve something they normally wouldn’t.
It tends to work because it doesn’t feel like a typical scam. The email might come from a real account, or it might closely mimic someone you already deal with, so there’s nothing obviously suspicious at first glance.
It’s also become harder to spot over time. The spelling mistakes and awkward phrasing that used to be a giveaway aren’t as common anymore. With AI tools, attackers can write emails that are clear, natural, and consistent with how people actually communicate at work.
That combination – familiarity, timing, and more convincing messages – is what makes BEC so effective.
Why Microsoft 365 Users Are a Prime Target
Microsoft 365 is where a lot of day-to-day work happens. Email, files, calendars, Teams chats – it’s all connected, which makes it incredibly useful, but also means there’s more at stake if something goes wrong.
From an attacker’s point of view, getting access to one account can open the door to a lot of information and activity. They can read emails, see how people communicate, and work out where money or sensitive information might be involved.
A few things make it particularly appealing:
- It’s widely used across businesses of all sizes
- Email and user identities are closely linked
- People can log in from different devices and locations
- Security features are available, but not always fully set up
None of this means Microsoft 365 is unsafe. It just means it needs to be configured properly and looked after, like any other important business system.
How Business Email Compromise Actually Happens
While each case can look a bit different, most BEC attacks tend to follow a similar pattern:
- Phishing emails are usually the starting point. These are designed to get someone to click a link or log in to what looks like a legitimate page, but isn’t.
- From there comes credential theft. Once login details are entered, the attacker can use them to access the real account.
- After that, attackers may access the account without anything obviously suspicious happening straight away. The attacker may spend time reading emails, understanding how the person communicates, and identifying anything involving payments or approvals.
- Finally, there’s impersonation. This is where the attacker steps in and sends requests – whether that’s asking for a payment, changing bank details, or requesting sensitive information. Because the email comes from a real account, or something very close to it, it doesn’t raise the same red flags as a typical scam.
That’s what makes these attacks so difficult to detect – by the time something feels off, the request has often already been actioned.
7 Ways to Prevent Business Email Compromise in Microsoft 365
The right setup can make a huge difference in keeping your business safe. Most attacks succeed because small gaps or defaults are left unaddressed, not because the technology itself is weak.
- Enable Multi-Factor Authentication (MFA) everywhere
MFA adds an extra layer of protection beyond just a password. Even if login details are stolen, it makes it much harder for an attacker to get in. Make sure it’s enabled for everyone, not just admins – attackers often start with regular accounts because they’re easier to access.
- Use Conditional Access policies
Conditional Access lets you control how and when people log in. For example, you can block logins from unusual locations or require extra verification for higher-risk sign-ins. It helps stop suspicious activity early, before it becomes a bigger problem.
- Strengthen email security settings
Microsoft 365 includes built-in protections, but they need to be set up correctly.
Key areas include:
- Anti-phishing policies
- Safe links and attachments
- Spoofing protection
Without proper email security configuration, many threats can slip through.
- Monitor login behaviour
Not every threat shows itself immediately.
Watch for:
- Logins from multiple locations in a short period
- Unusual access patterns
- Activity outside normal working hours
Spotting these early can make a big difference in limiting damage.
- Limit admin access
Accounts with high-level permissions can do the most damage if compromised. Using a least-privilege approach ensures people only have access to what they need for their job, without creating unnecessary risk.
- Train your team to spot suspicious emails
Technology is important, but people are still the first line of defence. Make sure your team knows what to look for, when to question a request, and how to report anything that doesn’t feel right. Regular, practical training builds awareness far more effectively than one-off sessions.
- Partner with a Managed Service Provider (MSP) for monitoring and response
Prevention is only part of the story. Ongoing monitoring and expert support can help detect issues early and respond quickly. Working with an MSP ensures you have someone keeping an eye on your environment, applying best-practice security configurations, and acting fast if something goes wrong.
If you’re not sure whether these are set up correctly in your environment, it’s worth reviewing your current configuration.
Common Challenges Businesses Face
Even with the right tools in place, there are a few common ways businesses still get caught out.
Some think that enabling MFA alone is enough, or that default security settings will protect them. Others treat security as a one-off task rather than something that needs ongoing attention. And no matter how prepared you are, expecting every employee to spot every suspicious email is unrealistic.
These gaps aren’t because companies aren’t trying – it’s usually about how the tools are set up and managed. Small misconfigurations or outdated practices can leave doors open for attackers. This is also where partnering with a Managed Service Provider (MSP) can make a real difference, helping ensure your environment is correctly configured, monitored, and maintained.
The Real Cost of Business Email Compromise
Business Email Compromise isn’t just an IT headache – it can have real consequences across the business.
That impact can include:
- Financial loss
- Disruption to operations
- Damage to relationships with customers and suppliers
- Time spent investigating and recovering
Even a single email can trigger these issues, and the costs add up quickly. Beyond the immediate financial hit, there’s often a ripple effect: delayed invoices, interrupted workflows, and extra work to reassure clients and partners. That’s why preventing BEC upfront is far cheaper, and less stressful, than dealing with it after the fact.
How Ever Nimble Can Help
Microsoft 365 is powerful, but it still needs the right oversight to keep your business secure from BEC threats and beyond. That means the right security settings, clear access controls, and ongoing monitoring to catch threats before they cause damage.
Our team of experts helps organisations across all these areas – reviewing your setup, strengthening email and identity security, and putting in place practical controls and monitoring. If you’d like us to review your Microsoft 365 environment, we can highlight risks, confirm your recovery and security posture, and outline simple, actionable next steps.
Learn more about our services, or get in touch with our team today to see how we can help protect your business.
FAQs
What is business email compromise?
Business Email Compromise is a type of cyber attack where attackers access or impersonate email accounts to trick people into sending money or sensitive information.
Can MFA stop BEC attacks?
MFA reduces risk significantly, but it should be used alongside other controls for stronger protection.
Why are Microsoft 365 accounts targeted?
Because they are widely used and connect key parts of the business, including email, identity and systems, making them an attractive target for attackers.
How do I know if my email has been compromised?
Signs can include unusual login activity, unexpected emails being sent, or changes to inbox rules or settings. If you notice anything unusual, we can help investigate and secure your account.
