Business email compromise in Montana: why the attacker is usually still in the mailbox
Business email compromise rarely ends when the wire goes out. What gets missed beforehand, what to do in the first hour, and where most cleanups fall short.
By Big Sky Cybersecurity Support
The attacker still had access for more than a week after the previous provider said the incident was closed.
The wire went out. The attacker didn't leave.
A Montana organization with fewer than ten employees lost about $70,000 to a single fraudulent wire. The attacker had been inside a finance mailbox, watching real payments go back and forth, and changed the bank details on one that was otherwise entirely legitimate.
Another IT provider handled the cleanup and called the incident closed. When the case reached us 80 days after the first compromise, the attacker still had access. Sessions had never been revoked, so they kept their way in for more than a week after the cleanup was supposed to have ended it.
That case isn't unusual. Business email compromise rarely starts and ends on the day the money moves. By the time anyone notices, the account has usually been compromised for weeks or months. Read the full case study.
What gets missed before the wire goes out
When we investigate these cases, the same gaps show up again and again:
- No multifactor authentication. One stolen password is enough.
- Weak spam filtering. The phishing email that started it reaches the inbox.
- Nothing watching the account. This is the one that matters most.
Without monitoring, nobody sees who is logging in, from where, or when. A sign-in from Singapore or Europe goes unnoticed. There's also a clock running. Depending on your license, Microsoft 365 and Google keep sign-in and activity logs for a limited time, often around 90 days. If an attacker has been in longer than that, the record of how they got in and what they touched can simply be gone.
Why it can go unnoticed longer in Montana
The attacks themselves aren't different here. What's different is how long they can go unseen.
Many Montana businesses are small and spread out, with no internal IT staff. The small cues, like an odd sign-in alert, a reply nobody remembers sending, or a missing email thread, are easy to miss when everyone is busy running the business.
The type of IT support matters too. A break-fix provider comes out when something is broken. They aren't usually watching sign-ins around the clock or running identity threat detection and response (ITDR), which records who is doing what, when and where, 24/7, and can lock an account down when it's phished.
What we do in the first hour
When someone calls us mid-incident, speed matters for two reasons: stopping the attacker, and keeping the evidence.
- Get into the admin center for Microsoft 365 or Google Workspace.
- Reset passwords and revoke every active session. A password reset alone doesn't end a session that's already open.
- Turn on multifactor authentication if it isn't already in place.
- Capture the logs straight away. Logs roll over and overwrite themselves. Every day that passes, critical evidence can disappear.
If you think an account is compromised right now, call 406-924-3731. Incident calls are answered by a person 24/7.
Where most cleanups fall short
The most common mistake we see is not getting the attacker fully out.
Attackers move fast once they're in. Within minutes of compromising an account, they start looking for ways to keep access even after passwords are changed and sessions are revoked. In Microsoft 365 and Entra, that often means registering or connecting a device that gives them a persistent way back in.
They also look for admin roles. If a compromised account has admin access to Microsoft or Google, attackers will often find it and use it to create new accounts of their own. Those accounts may never show up in a normal review, and you might not learn they exist until something else goes wrong.
That's why a real cleanup goes beyond resetting a password. It means checking connected devices, mailbox and forwarding rules, app permissions, admin roles, and every account in the tenant, then documenting what was found.
What to put in place now
- Multifactor authentication on every account, including admins.
- A spam filter built to catch impersonation emails aimed at finance staff.
- Monitoring of sign-ins and account activity, ideally with ITDR that reacts automatically.
- Longer log retention, so the evidence still exists if you ever need it.
- A callback rule for any request to change payment or bank details, using a number you already have on file.
If it's already happened
At Big Sky Cybersecurity, we investigate business email compromise for Montana organizations from five people to more than 200, and we work alongside your existing IT provider. You get a documented timeline, the attack vector, what was accessed, and a written report you can take to law enforcement, your insurer or your counsel. See our incident response and digital forensics services, or call 406-924-3731.
Business email compromise is one of several situations where forensic evidence matters. Our overview of five scenarios where digital forensics helps covers the others.
Common questions
Short answers to the questions we hear most about this topic.
What is business email compromise?
Business email compromise is when an attacker takes over or impersonates a real email account to trick someone into sending money, changing payment details or sharing sensitive information. It usually starts with a phishing email that steals a password, then the attacker quietly watches the mailbox until a real payment comes along.
How is business email compromise different from phishing?
Phishing is usually how it starts. The phishing email steals the password. Business email compromise is what the attacker does next: living inside a real mailbox, learning how your business pays its bills, and using a trusted account to redirect money. Because the emails come from a real account, they look normal to everyone involved.
Can we get the money back after a fraudulent wire?
Sometimes, if you move fast. Report it to the authorities right away. The chances of recovery drop quickly once the money moves on from the receiving account. Then call an incident response team, because the account that sent the instructions is very likely still compromised.
How long do Microsoft 365 and Google keep sign-in logs?
It depends on your license, but often around 90 days. After that, the record of who logged in and from where can be gone. If you think an account was compromised weeks ago, export the logs now, before they roll over.
Is resetting the password enough after an email account is compromised?
No. A password reset doesn't end sessions that are already open, and attackers often set up other ways back in within minutes, such as registering a device or creating new accounts with admin rights. A proper cleanup revokes every session, checks devices, mailbox rules, app permissions and admin roles, and documents what was found.
How do you prevent business email compromise?
Turn on multifactor authentication for every account, use email filtering built to catch impersonation, and have something watching sign-ins around the clock, such as identity threat detection and response. Keep logs longer than the default, and make it a rule to call a vendor back on a number you already have before changing any payment details.
We already have spam filtering. Isn't that enough to stop phishing?
Basic spam filters catch junk and obvious scams. Many modern phishing emails come from legitimate services or compromised accounts, carry no obvious malware attachment, and are written specifically to get past simple filters. You need advanced email security with time of click link protection, plus staff training.
Terms used in this article
Plain definitions, so nothing above needs a second search.
Think an account is compromised right now?
Same day onsite for contract clients. Everyone else pays $275 an hour, with no emergency surcharge, and gets forensic imaging before remediation.
See incident responseAll articles