Email Compromise Investigation: How to Investigate Unauthorized Email Access, Suspicious Rules and Account Activity
Email is one of the most important digital systems inside a modern organization.
It contains conversations, invoices, contracts, password-reset messages, customer information, internal documents, security notifications and links to other business systems.
That makes an email account valuable to an attacker.
A compromised mailbox can be used quietly. An attacker may read messages without deleting anything, create hidden forwarding rules, monitor financial conversations, impersonate an employee, reset passwords for other services or wait for the right moment to interfere with a payment.
By the time the organization notices, the attacker may have been present for days or weeks.
An email compromise investigation examines available authentication records, mailbox activity, forwarding rules, security changes, devices, sessions, administrative events and related digital evidence to determine what happened.
The investigation should answer more than:
“Was the password changed?”
It should attempt to determine:
Was the account actually accessed without authorization?
When did suspicious activity begin?
How might access have been obtained?
What did the unauthorized user do?
Were messages read, searched, forwarded, deleted or sent?
Were mailbox rules created?
Were security settings changed?
Did the compromise spread to other accounts or systems?
Does unauthorized access remain?
Those questions are the foundation of a professional email compromise investigation.
What Is Email Account Compromise?
Email account compromise occurs when an unauthorized party gains access to or control over an email account or associated session.
This can affect personal accounts, employee mailboxes, executive accounts, shared mailboxes and administrative accounts.
Attackers may obtain access through phishing, stolen credentials, password reuse, malicious applications, compromised devices, stolen sessions, social engineering or other methods.
But suspicious activity does not automatically prove which method was used.
The investigation should follow the evidence.
Email Compromise Can Be Difficult to Notice
Not every attacker immediately sends obvious spam.
A sophisticated intrusion may be quiet.
The attacker may simply monitor conversations.
This can be especially dangerous when the mailbox belongs to someone involved in payments, contracts, payroll, purchasing, executive decisions or customer relationships.
The attacker can learn how the organization communicates before taking visible action.
Warning Signs of Possible Email Compromise
Possible indicators include unfamiliar successful logins, unexpected MFA prompts, unknown devices, password-reset notifications, messages appearing read unexpectedly, emails disappearing, unfamiliar sent messages, new forwarding addresses, suspicious inbox rules, changed recovery information, unfamiliar application access, unusual sign-in alerts or contacts receiving messages the account owner did not send.
Any one indicator can have an innocent explanation.
The investigation should determine whether several pieces of evidence support unauthorized access.
Email Compromise Investigation vs. Password Reset
Changing the password is an important containment step.
It is not an investigation.
A password reset does not explain:
When the attacker entered.
How access was obtained.
What messages were accessed.
Whether forwarding rules were created.
Whether other accounts were compromised.
Whether existing sessions remain active.
Whether malicious application access exists.
Or whether information obtained from the mailbox was later used elsewhere.
Containment and investigation serve different purposes.
Preserve Evidence Before Deleting Suspicious Activity
Users understandably want to remove suspicious rules, delete malicious messages and reset everything immediately.
Some containment may need to happen quickly.
But where practical, relevant evidence should be documented or preserved before it disappears.
Our Digital Evidence Preservation guidance applies directly here.
Useful evidence can include suspicious messages, message headers, forwarding rules, inbox rules, authentication records, security alerts, device information, session data, account changes, administrative logs and related communications.
Build an Email Compromise Timeline
A timeline can transform scattered alerts into a coherent incident.
Consider:
May 6 — Phishing message delivered
May 6 — User visits external sign-in page
May 6 — Suspicious authentication occurs
May 6 — New mailbox rule created
May 7 — Financial conversations accessed
May 10 — Vendor invoice conversation monitored
May 12 — Fraudulent payment instructions sent
May 13 — Organization discovers the incident
The business may initially believe the compromise began with the fraudulent email on May 12.
The evidence may show that unauthorized access began six days earlier.
That distinction matters.
Authentication Evidence
Authentication records are often one of the first evidence sources examined.
Depending on the provider and configuration, investigators may be able to review timestamps, accounts, IP addresses, devices, applications, authentication methods, MFA events and other sign-in information.
But authentication evidence needs careful interpretation.
Successful Login Does Not Automatically Mean the Account Owner Logged In
If an employee’s account successfully authenticates, the record establishes activity involving that account.
It does not automatically establish the human actor.
Credentials could have been stolen.
A session could have been compromised.
An authorized user could be traveling.
A VPN could alter the apparent location.
A shared account could have multiple legitimate users.
The evidence must be correlated.
IP Addresses and Email Investigations
IP information can be useful for comparing activity.
Investigators may identify authentication from infrastructure that does not match expected activity.
But an IP address does not automatically reveal who accessed the account.
VPNs, proxies, cloud services, mobile networks, shared connections and compromised systems can all complicate interpretation.
An IP address should be treated as one piece of evidence.
Impossible Travel and Geographic Alerts
Some email platforms generate alerts when authentication appears to occur from geographically distant locations within an implausibly short period.
These alerts can be useful.
But they are not absolute proof of compromise.
VPN usage, mobile networks, cloud services and inaccurate geolocation can produce unusual location patterns.
Investigators should examine the underlying events rather than relying solely on the alert label.
Multi-Factor Authentication Does Not Eliminate Investigation
MFA can significantly improve account security.
But an MFA-protected mailbox can still become compromised.
Attackers may use phishing techniques, stolen authenticated sessions, malicious applications, recovery processes, compromised endpoints or other mechanisms.
Therefore:
“MFA was enabled” does not prove unauthorized access was impossible.
The investigation should determine what actually occurred.
MFA Changes
Unexpected changes to authentication methods deserve attention.
Investigators may examine whether new MFA methods, devices or recovery options were added.
The timing can be important.
If an unfamiliar authentication method appears shortly after suspicious access, that may indicate an attempt to maintain control.
But administrative changes should still be checked for legitimate explanations.
Session Theft
Sometimes an attacker does not need the user’s password.
If an authenticated session is stolen or hijacked, the attacker may potentially access an account without performing a conventional password login.
This can explain incidents where the user changed their password but suspicious activity continued.
Investigators should therefore consider session evidence where the platform provides it.
Revoke Active Sessions
During containment, organizations may need to revoke active sessions in addition to changing credentials.
The exact procedure varies by platform.
The investigative point is that password change and session termination are not always the same event.
Inbox Rules
Mailbox rules are particularly important evidence.
An attacker may create a rule that automatically moves certain messages.
For example, messages containing words such as:
“invoice”
“payment”
“bank”
“wire”
“statement”
or the name of a particular vendor may be moved to another folder.
This can prevent the legitimate account owner from seeing replies or warnings.
Hidden or Unfamiliar Rules
Attackers may give rules ordinary-looking names or configure them in ways that make them less noticeable.
Investigators should examine what the rule does, when it was created, whether logs indicate who created it and what messages it affected.
Finding a suspicious rule is important.
But the rule should be incorporated into the larger timeline.
External Email Forwarding
Forwarding can allow messages to leave the mailbox automatically.
Investigators may examine whether an external forwarding address was configured, when it appeared and whether it corresponds with other suspicious events.
A legitimate employee may also use authorized forwarding.
Context and company policy matter.
Deleted and Hidden Messages
Attackers may delete messages to conceal activity.
They may also move messages into folders the user rarely checks.
Depending on the email environment and retention settings, investigators may be able to examine deletion activity, folder movement, retained copies or other evidence.
Recovery is not guaranteed.
Retention policies and the amount of time elapsed matter.
Sent Email Investigation
If fraudulent or unauthorized messages were sent from a compromised account, investigators may examine message records, headers, timestamps, recipients and associated account activity.
The goal is to determine whether the message actually originated through the compromised mailbox, was spoofed externally, or was created through another mechanism.
That distinction can be important.
Email Spoofing vs. Account Compromise
A fraudulent message that appears to come from an employee does not necessarily mean the employee’s mailbox was hacked.
Email addresses can sometimes be spoofed.
An attacker may also register a lookalike domain.
For example, a legitimate domain might be:
examplecompany.com
while the attacker uses a visually similar domain.
These are different incidents.
A proper investigation should distinguish between:
actual mailbox compromise
email spoofing
lookalike-domain impersonation
and
compromised third-party accounts.
Message Headers
Email headers can contain useful technical information about message routing and authentication.
Depending on the case, they may help investigators examine where a message traveled, which servers handled it and whether email-authentication controls produced relevant results.
But headers should be interpreted carefully.
Some fields can be manipulated, while others are added by trusted infrastructure.
A screenshot of an email does not contain the same technical information as the original message and its full headers.
Phishing as a Possible Entry Point
Phishing is one possible cause of email compromise.
An attacker may send a message directing the user to a fake sign-in page designed to capture credentials or facilitate another form of unauthorized access.
If the original phishing message still exists, preserve it.
The message, destination domain, timing and subsequent authentication activity can potentially help reconstruct the incident.
But finding a phishing message does not automatically prove that the user interacted with it.
Password Reuse
Credentials exposed through another service may sometimes be reused against an email account.
Investigators should not assume this occurred merely because a password was reused historically.
Authentication records, breach information, account alerts and other evidence may help evaluate the possibility.
Malicious Application Access
Modern email platforms can integrate with third-party applications.
An attacker may attempt to obtain access through a malicious or unauthorized application rather than repeatedly using the user’s password.
Depending on the environment, investigators may examine application authorizations, permissions, consent events and related audit records.
This can be particularly important when suspicious activity continues after a password change.
Administrative Account Compromise
An attacker who compromises an email administrator may gain broader access than an ordinary mailbox user.
Potential activity could include account changes, password resets, forwarding configuration, security-policy modifications or other administrative actions.
An administrator compromise should therefore be treated as potentially broader than a single mailbox incident.
Shared Mailboxes
Shared mailboxes complicate attribution because several authorized users may access the same messages.
Investigators should determine who had legitimate access during the relevant period and what audit records are available.
A message being accessed through a shared mailbox does not automatically identify which person viewed it.
Executive Email Compromise
Executive accounts can be attractive targets because they may contain sensitive strategic information and carry organizational authority.
An attacker may impersonate an executive to request payments, confidential documents, credentials or urgent actions.
But investigators should still distinguish between actual account compromise and external impersonation.
Business Email Compromise
Email compromise can become part of a larger Business Email Compromise Investigation when attackers manipulate business communications for financial fraud.
A common scenario involves monitoring an existing conversation and intervening when payment is expected.
The fraudulent message may change banking details or redirect payment.
In these cases, investigators need to examine both the email evidence and the financial-fraud timeline.
Vendor Email Compromise
Sometimes the organization’s own mailbox is not compromised.
The attack may begin with a supplier, customer, law firm, accountant or other business partner.
If an attacker compromises the vendor’s real mailbox, fraudulent instructions may arrive through an authentic email account and existing conversation.
That can make the fraud much harder to detect.
Investigators should avoid assuming which side was compromised until the evidence is examined.
Conversation Hijacking
Attackers who can read email may learn the language, timing and context of an existing conversation.
They may then intervene at a strategically useful moment.
For example, they may wait until an invoice is expected before changing payment instructions.
The fraudulent message can appear convincing because the attacker already understands the relationship.
Timeline reconstruction becomes particularly important in these cases.
Was the Mailbox Being Monitored?
One of the harder questions is whether an attacker merely accessed the account or actively monitored particular conversations.
Evidence may include mailbox activity, rules, forwarding, searches, message access, application activity and timing.
The availability of this evidence varies significantly between providers and licensing configurations.
Investigators should not promise visibility that the email platform does not provide.
Email Search Activity
Some enterprise platforms may preserve audit events related to mailbox searches or other activity.
Where available, these can help investigators understand what information may have interested the unauthorized user.
But audit capabilities vary.
The absence of a particular event does not automatically prove that an action did not occur.
Password Reset Emails for Other Accounts
A compromised mailbox can become a gateway to additional systems.
Attackers may request password resets for cloud platforms, social media, financial systems, business applications or other services connected to the email address.
Investigators should examine whether the email compromise was followed by suspicious activity elsewhere.
An Account Takeover Investigation may therefore become part of the case.
Email Compromise and Cloud Accounts
Many organizations use the same identity platform for email and cloud applications.
A compromised account may therefore provide access beyond the mailbox.
Depending on permissions, the attacker could potentially reach documents, collaboration tools, storage, applications or administrative systems.
The investigation should determine the actual scope rather than assuming the incident is email-only.
Email Compromise and Mobile Devices
Mobile devices can provide additional evidence.
A phone may contain security alerts, authentication prompts, email activity or other relevant artifacts.
However, a full device examination is not always necessary.
The scope should be proportional to the incident and the organization’s authority to examine the device.
Compromised Employee Device
Sometimes the mailbox is only one symptom of a compromised endpoint.
Malware, malicious browser extensions, credential theft or other device compromise may contribute to unauthorized account access.
If evidence suggests the user’s computer or phone is involved, broader digital forensics may be appropriate.
What Messages Did the Attacker Access?
This is one of the most common questions.
Unfortunately, the answer depends heavily on the email provider, audit configuration, retention period and licensing.
Some environments preserve detailed mailbox activity.
Others provide limited visibility.
A professional investigation should clearly state what can and cannot be determined from the available evidence.
Did the Attacker Download Attachments?
Again, this depends on available audit information.
An investigator should not assume that because an attacker accessed the mailbox, every attachment was downloaded.
The strongest conclusion should match the evidence.
Did the Attacker Steal Data?
Email accounts can contain sensitive information.
If evidence suggests confidential documents, customer information, employee records or other protected data may have been accessed, the incident may require a broader Data Breach Investigation.
But mailbox access and confirmed data exfiltration are not automatically the same finding.
Email Log Forensics
Authentication and audit logs can be central to reconstructing an email incident.
Investigators may correlate:
Sign-in activity.
Mailbox rules.
Forwarding.
Security changes.
Application access.
Message events.
Administrative actions.
Device information.
And other records.
The goal is not to produce hundreds of pages of raw audit events.
It is to build an understandable timeline.
Normalize Timestamps
Email platforms, security products and users may display different time zones.
Before correlating events, investigators should normalize timestamps.
Otherwise, a phishing message, suspicious login and mailbox-rule creation may appear in the wrong sequence.
Do Not Overinterpret Location Data
A login may be labeled as coming from a particular city or country.
That location is generally inferred from network information.
It should not be treated as precise physical location evidence.
VPNs, proxies, mobile networks and cloud infrastructure can substantially affect apparent location.
Determine the Scope
A single compromised mailbox can sometimes indicate a larger incident.
Investigators may need to ask:
Were other employees targeted?
Did the same infrastructure access multiple accounts?
Were similar mailbox rules created elsewhere?
Was an administrator account involved?
Were cloud applications accessed?
Were payments redirected?
Did the attacker obtain credentials for additional systems?
Scope determination can prevent the organization from treating a broader incident as an isolated mailbox problem.
Containment and Investigation Should Work Together
During an active incident, organizations may need to reset credentials, revoke sessions, remove malicious rules, disable unauthorized applications, secure recovery methods and take other containment actions.
Those steps should not be delayed merely to preserve a perfect forensic environment.
Where possible, preserve relevant evidence first and document the changes made during containment.
What an Email Compromise Investigation May Determine
Depending on the provider and available evidence, an investigation may help determine:
- Whether suspicious authentication occurred
- Approximately when unauthorized access began
- Which accounts were affected
- Whether unfamiliar devices or sessions were involved
- Whether MFA or recovery settings changed
- Whether suspicious inbox rules were created
- Whether messages were automatically forwarded
- Whether unauthorized messages were sent
- Whether third-party applications received access
- Whether the attacker may have monitored financial conversations
- Whether activity spread into other accounts or cloud services
- Whether evidence supports phishing, credential compromise or another access path
- Whether the incident became business email compromise
- Which questions cannot be answered because relevant evidence is unavailable
The evidence—not the initial suspicion—should determine the conclusions.
What Email Forensics Cannot Automatically Prove
A suspicious IP address does not automatically identify the attacker.
An unfamiliar location does not automatically prove compromise.
A phishing message does not prove the recipient entered credentials.
A mailbox rule does not automatically establish who created it.
A successful login does not automatically identify the person operating the account.
Mailbox access does not automatically prove every email or attachment was read.
And a password reset does not automatically prove all unauthorized access has ended.
These distinctions make the investigation more defensible.
How Cyb3rsect Approaches Email Compromise Investigations
Cyb3rsect begins by identifying the affected account, the reason compromise is suspected, the approximate timeframe and the business questions that need to be answered.
Available evidence may include authentication records, email audit data, mailbox rules, forwarding configuration, security alerts, administrative activity, application permissions, original suspicious messages, message headers and related account evidence.
Events are normalized into a common timeline.
Suspicious authentication can then be compared with mailbox changes, forwarding, message activity, financial conversations, security modifications and activity in connected systems.
Alternative explanations are tested.
If a fraudulent message appears to come from an employee, the investigation should determine whether the real mailbox was compromised, the address was spoofed or a lookalike domain was used.
If suspicious activity continues after a password change, sessions, application permissions and other access mechanisms may require examination.
Observed evidence is separated from inference.
Evidence gaps are documented.
The objective is to determine when unauthorized activity began, what occurred inside the account, how far the incident extended and what the available evidence can actually establish.
Contact Cyb3rsect About a Suspected Email Compromise
If an employee, executive, shared mailbox or business email account may have been accessed without authorization, preserve available security and audit evidence as early as possible.
Cyb3rsect provides email compromise investigation, business email compromise investigation, account takeover investigation, cyber investigation, digital forensics and digital evidence preservation support.
Useful starting information can include the affected email address, approximate discovery date, email provider, suspicious login alerts, fraudulent messages, original message files or headers, unfamiliar forwarding rules, account-security changes, known financial fraud and details of containment already performed.
Do not send passwords, MFA codes, recovery codes, session tokens or other authentication secrets through an ordinary initial inquiry.
If money has been transferred fraudulently, contact the relevant financial institution promptly through a verified channel. Appropriate law-enforcement or legal reporting may also be time-sensitive depending on the circumstances.
Contact Cyb3rsect to determine which authentication records, mailbox activity, forwarding rules, message evidence, security events and other digital evidence may still be available for investigation.
A Password Reset Does Not Explain an Email Compromise
Securing the account is essential.
But an organization still needs to understand what happened.
When did unauthorized access begin?
How was the account accessed?
Were suspicious rules created?
Was mail forwarded externally?
Were messages monitored?
Were fraudulent messages sent?
Were other systems accessed through the mailbox?
Was the incident actually spoofing rather than account compromise?
Did the attacker retain access after the password changed?
What does the evidence prove—and what remains unknown?
Those questions are the foundation of a professional email compromise investigation.
