The Email Was Genuine, but the Link Wasn’t: How to Investigate Phishing Through Compromised Business Accounts

You receive an email from a supplier, colleague, business partner or customer. The sender’s name is familiar. The email address appears correct. The message refers to an ongoing project, an invoice or a conversation you genuinely had.

Nothing immediately looks unusual.

Then you click the link.

It opens a page asking you to sign in, review a document, verify payment details or download a file. You enter your information, unaware that the email may have come from a legitimate account that someone else has taken control of.

This is one of the more difficult forms of phishing to recognise. Unlike a basic impersonation email sent from an unrelated address, a message sent through a compromised business account may arrive from a genuine mailbox with an established communication history.

The attacker may have access to previous conversations, contact lists and business documents. They can use that information to create messages that fit naturally into existing relationships.

The result can be credential theft, unauthorised mailbox access, fraudulent invoices, payment diversion or further attacks against other organisations.

Investigating these incidents requires looking beyond the email itself. The sender’s mailbox, authentication history, message headers, embedded links, recipient activity and related financial records may all provide important evidence.

This guide explains how to investigate phishing sent through compromised business accounts, identify suspicious links, preserve email evidence and establish what may have happened after a message was delivered.

1. Understand Why Phishing From a Genuine Account Is Different

Traditional phishing often relies on impersonation. An attacker creates an email address that resembles a real company or person and sends messages designed to persuade recipients to reveal information.

A compromised business account creates a different situation.

The attacker may be using the actual mailbox of a legitimate person or organisation. This can make the message appear consistent with previous communications.

For example, a compromised supplier account might send an email containing:

• An invoice that appears to belong to an existing project.
• A document-sharing notification.
• Updated bank account details.
• A request to review a contract.
• A link to a familiar business portal.
• A message continuing an existing email conversation.

The recipient may recognise the sender and have no reason to suspect that another person is controlling the account.

The important distinction is that a genuine sender address does not necessarily mean the person who sent the message was authorised to do so.

An investigation should establish whether the account owner actually initiated the communication and whether the message’s contents and destination were legitimate.

2. Preserve the Original Email Before Deleting It

The original email is a critical source of evidence.

A screenshot may show the visible message, but it usually does not preserve all the technical information needed to investigate how the email was transmitted.

Where possible, save or export the original message in its native email format. Depending on the email service, this may be available through options such as downloading the message or exporting it as an EML or MSG file.

Preserve:

• The original message.
• Full email headers.
• Sender and recipient addresses.
• Subject line.
• Date and time received.
• Message ID.
• Reply-to address.
• Embedded links.
• Attachment names.
• Attachment files, where safe to preserve.
• Any related messages in the conversation.

Do not forward the suspicious email as your only preservation method. Forwarding can alter parts of the message and may omit information contained in the original headers.

Keep a record of when the email was received and when it was discovered to be suspicious.

Cyb3rsect’s Email Forensics resources provide further context on preserving and examining email evidence.

3. Examine the Email Headers

Email headers contain technical information about how a message was handled as it travelled between mail systems.

They can help investigators assess the message’s origin, routing and authentication results.

Relevant header fields may include:

• From.
• Return-Path.
• Reply-To.
• Message-ID.
• Received.
• Authentication-Results.
• SPF.
• DKIM.
• DMARC.

These fields should be examined together rather than interpreted in isolation.

For example, a visible From address may show the familiar business contact, while the Reply-To field points somewhere unexpected.

The Received headers can provide information about the systems involved in message delivery. However, header interpretation requires care because some fields can be added or influenced by different mail systems.

Email authentication results can also be useful:

SPF (Sender Policy Framework) checks whether the sending server is authorised under the relevant domain’s SPF policy.

DKIM (DomainKeys Identified Mail) uses a cryptographic signature to help verify that a message was signed by a domain and that signed content has not been altered in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance) allows domain owners to specify how receiving systems should handle messages that fail relevant authentication checks.

A message passing SPF, DKIM or DMARC does not prove that its contents are safe. If an attacker has taken control of a genuine mailbox, the message may pass normal domain authentication checks.

This is why investigators must examine the mailbox activity and account security records as well as the email headers.

4. Investigate Whether the Sender’s Account Was Compromised

One of the most important questions is whether the genuine sender’s mailbox was accessed by an unauthorised person.

If the account owner is available, ask them to confirm whether they sent the message and whether they recognise the link or attachment.

The organisation controlling the mailbox should review available security and authentication records.

Depending on the email provider and account configuration, relevant information may include:

• Sign-in history.
• Unfamiliar devices.
• Unusual IP addresses.
• Unexpected authentication challenges.
• New application permissions.
• Suspicious mailbox rules.
• Forwarding configuration changes.
• Password-reset activity.
• Changes to recovery information.
• Unrecognised connected applications.

For business environments, administrators may have access to additional audit records showing mailbox access, configuration changes and other account activity.

An unfamiliar IP address does not automatically establish unauthorised access. Remote work, VPN services, mobile networks and corporate gateways can affect the apparent location of a connection.

The investigation should compare the event with the account owner’s normal activity and other available evidence.

5. Check for Suspicious Mailbox Rules and Forwarding

Attackers who gain access to a business mailbox may try to maintain visibility over incoming and outgoing communications.

One technique involves creating mailbox rules or forwarding arrangements.

These settings can sometimes be used to:

• Forward messages to an external address.
• Move security notifications into another folder.
• Hide messages containing payment instructions.
• Redirect replies.
• Mark selected messages as read.
• Conceal communications about a suspected incident.

An investigator should review mailbox rules, forwarding addresses, delegated access and connected applications.

Pay particular attention to changes made shortly before or after the suspicious email was sent.

A rule that forwards messages to an unfamiliar external account may be an important lead, but it should be documented and examined in context.

Preserve the configuration details and available audit records before making changes where practical. If the account is actively compromised, securing it takes priority.

6. Examine the Link Without Opening It

The link inside a suspicious email may lead to a website designed to collect credentials, distribute malware or imitate a trusted business service.

Do not open the link directly on a device used for sensitive business activity.

First, preserve the URL as it appears in the original message. Some email clients display shortened or descriptive text that differs from the actual destination.

For example, a message may display a familiar company name while the underlying link points to an unrelated domain.

Examine:

• The visible link text.
• The actual destination URL.
• The registered domain.
• Subdomains.
• URL redirection behaviour.
• Domain spelling and structure.
• Whether the destination imitates a known service.
• Whether the URL contains unusual parameters.

Be careful with shortened URLs and redirect services. The visible destination may not reveal the final website.

If technical examination is required, use an appropriate controlled environment and established analysis procedures. Avoid submitting confidential business URLs or private documents to public scanning services without considering the organisation’s data-handling requirements.

A suspicious URL is an investigative lead, not proof of who operated the website.

7. Investigate the Website Behind the Link

The website may provide additional information about the phishing operation.

A fraudulent page may imitate a Microsoft 365 sign-in screen, a cloud document portal, a supplier payment system or a familiar financial service.

Examine the website’s presentation and technical characteristics where this can be done safely.

Potential areas of investigation include:

• Domain registration information.
• DNS records.
• Hosting information.
• TLS certificate details.
• Page content.
• Branding and logos.
• Redirects.
• Login form behaviour.
• External scripts and resources.
• Similarity to a genuine service.

A valid HTTPS certificate only indicates that a connection to the website is encrypted. It does not prove that the website or its operator is legitimate.

Look for inconsistencies between the claimed organisation and the actual domain.

A phishing page may also disappear quickly, so preserve relevant URLs, screenshots and available technical observations with their timestamps.

8. Determine Whether Credentials Were Entered

If a recipient entered their password into a suspicious page, investigate whether the account may have been exposed.

Ask:

• Which account was entered?
• Was the password reused elsewhere?
• Was a multifactor authentication prompt received?
• Was the prompt approved?
• Did the user enter a verification code?
• Did the website request additional information?
• Did the account show suspicious activity afterwards?

Do not ask the user to send passwords, authentication codes or recovery phrases to an investigator.

If credentials may have been exposed, change the affected password from a trusted device, revoke unknown sessions and review account security settings.

Where the same password was used on other services, those accounts should also be assessed.

A password change is important, but it may not remove every existing session or unauthorised application connection. Review those separately.

9. Examine Attachments and Downloaded Files

Some phishing messages use attachments rather than links.

They may appear to be:

• Invoices.
• Purchase orders.
• Contracts.
• Delivery notices.
• Shared documents.
• Security updates.
• Account statements.

A file may contain malicious content, links to external websites or instructions intended to persuade the recipient to enable additional functionality.

Preserve the original attachment without opening it on an ordinary workstation.

Record its filename, size, file type and available hash value. If specialist analysis is appropriate, examine the file in a controlled environment.

Do not assume that a document is safe because it opens normally or appears to contain ordinary business information.

Equally, an unfamiliar file extension or unusual document does not automatically prove malicious intent. Findings should be based on technical examination and supporting evidence.

10. Investigate Whether the Attack Spread to Other Accounts

A compromised business mailbox may be used to target other people.

The attacker may send messages to customers, suppliers, employees or contacts in the mailbox’s address book.

Review available sent-mail records and relevant account activity.

Look for:

• Messages the account owner does not recognise.
• Unusual bursts of outgoing emails.
• Messages sent to unfamiliar recipients.
• Repeated links or attachments.
• Unexpected replies from contacts.
• New email forwarding rules.
• Changes to distribution lists.
• Unauthorised access to shared documents.

If the account belongs to a business, the incident may affect more than one person.

The organisation should identify potentially affected recipients and follow its incident-response and notification procedures.

Avoid deleting suspicious sent messages before preserving relevant records.

11. Investigate Business Email Compromise and Payment Diversion

Phishing through a compromised business account can develop into a financial fraud incident.

An attacker who can read ongoing conversations may learn when invoices are due, who approves payments and how suppliers normally communicate.

They may then send altered payment instructions or intervene in an existing conversation.

Warning signs can include:

• Unexpected changes to supplier bank details.
• A replacement invoice.
• New payment instructions sent from a familiar account.
• Requests to use a different beneficiary.
• Unusual urgency around a transfer.
• A message asking for secrecy.
• A discrepancy between previously verified details and new instructions.

If payment instructions have changed, verify them using a separate, previously established contact method. Do not rely on the telephone number or link contained in the suspicious email.

If money has already been transferred, contact the bank or payment provider immediately through official channels.

Preserve invoices, original emails, payment confirmations, beneficiary information and communication records.

For more detail on this type of incident, see Cyb3rsect’s article on business email compromise and payment diversion.

12. Build a Timeline of the Incident

A timeline helps connect the suspicious email with account access, recipient activity and any financial consequences.

Event	Evidence to preserve
Last known legitimate communication	Original email and headers
Suspicious sign-in	Account activity and authentication records
Mailbox settings changed	Audit records and rule details
Phishing email sent	Original message and Message-ID
Recipient receives message	Mailbox record and timestamp
Link opened	Browser history and available security records
Credentials entered	User account and authentication records
Unauthorised activity occurs	Account logs and transaction records
Incident discovered	Screenshots and incident notes
Response begins	Password changes, session revocation and provider reports

Use timestamps from original records wherever possible.

If different systems display time in different zones, document the conversion rather than silently changing the original timestamp.

The timeline should distinguish confirmed events from estimated events and unresolved questions.

13. What to Do If You Receive a Suspicious Email From a Genuine Contact

If an email from a familiar business contact contains an unexpected link or payment request, do not assume that the account is safe simply because you recognise the sender.

Take these steps:

1. Do not click unexpected links or open suspicious attachments.
2. Preserve the original email and its headers.
3. Contact the sender using a separate, trusted communication method.
4. Ask the sender’s organisation to check its mailbox security.
5. Report the message to your IT or security team.
6. If credentials were entered, change them from a trusted device.
7. Revoke unfamiliar account sessions and connected applications.
8. Review mailbox forwarding rules and recovery settings.
9. Contact your bank promptly if payment information may have been exposed.
10. Preserve all relevant evidence before deleting messages or resetting devices.

If the email account is part of a business environment, follow the organisation’s incident-response procedures and involve the appropriate administrators.

How Cyb3rsect Can Help Investigate Compromised Business Email Accounts

A compromised business mailbox can leave evidence across email systems, cloud services, browsers, devices and financial records.

The original message may show how the phishing attempt was presented. Email headers may help establish the message’s delivery path. Account audit records may reveal suspicious sign-ins or mailbox changes, while browser and endpoint evidence may help explain what happened after a recipient clicked the link.

Cyb3rsect focuses on digital forensics, cyber investigations and online fraud intelligence.

Depending on the available evidence and agreed scope, an investigation may involve:

• Examining suspicious emails and original message headers.
• Reviewing available mailbox and authentication records.
• Investigating suspicious forwarding rules and account changes.
• Assessing phishing URLs and associated websites.
• Reviewing relevant browser and device evidence.
• Examining suspicious attachments.
• Building a timeline of communications and account activity.
• Reviewing payment diversion evidence.
• Identifying technical inconsistencies and investigative leads.
• Preparing a structured report of findings and limitations.

The presence of a phishing email does not by itself establish who controlled the sender’s account or who operated the destination website.

A sound investigation separates verified technical findings from assumptions and identifies what additional records may be needed.

The objective is to understand how the incident developed, preserve the evidence and provide a clearer basis for appropriate next steps.

Final Thoughts

The most convincing phishing email may not come from an obvious imitation address.

It may arrive through a genuine business mailbox that has been compromised. It may refer to a real project, continue an existing conversation and use information that only the sender and recipient would normally know.

That is why recognising the sender is not enough.

Preserve the original message, examine the headers, verify unexpected links independently and investigate the account that sent the communication. If credentials or payment details were exposed, secure the affected accounts and contact the relevant providers promptly.

The key investigative questions are who controlled the mailbox, how the message was sent, where the link led, what information was exposed and whether further unauthorised activity followed.

For digital forensics, email investigations and online fraud intelligence, visit Cyb3rsect.