If you are deciding what to do if a business email account is compromised, start by containing access and alerting the right people. A password change can help, but it may not end existing sessions or remove other ways an intruder can access the mailbox. Treat the incident as an access and business-continuity issue: secure the account, inspect its settings, and find out whether messages or money were affected.
Use a trusted device and a communication channel outside the affected account to coordinate. If your business has an IT or security lead, contact them promptly. NIST's incident-response recommendations can help organizations structure how they prepare for and handle cybersecurity incidents.
Contain the compromised account first
- Alert your IT contact through a separate channel. Call, text, or use another account you trust. Tell them which mailbox is affected, when the issue was noticed, and what unusual activity you have seen. Do not use the possibly compromised mailbox to coordinate the response.
- Ask an administrator to block access if the account is still being misused. Where available, temporarily disable sign-in or otherwise restrict the account while the response is underway. The right action may depend on the business's email system and whether access is actively being abused.
- Reset the password from a trusted device. Use a new, unique password. If the old password was reused elsewhere, change it for those accounts too, starting with accounts that can be used to reset or access business systems.
- Revoke active sessions and tokens. Have an administrator sign the account out of existing sessions wherever the system allows. A password reset alone may not close every active session or remove every connected application. Check for unfamiliar apps or other access that should be removed.
- Review multifactor authentication and recovery methods. Remove methods the account owner does not recognize, such as an unfamiliar phone number, authenticator, recovery address, or security key. Re-establish trusted methods before returning the account to normal use.
If you cannot reach an administrator quickly and the account appears to be sending messages or changing settings, use the provider's available account-security controls and contact support. Preserve what you can, but do not let evidence collection delay urgent containment.
Check for changes that could keep an attacker connected
After restricting access, inspect the mailbox and account settings with an administrator. Look for changes the owner did not make, including:
- Forwarding settings: Check whether messages are being sent automatically to an unfamiliar address.
- Inbox rules: Review rules that move, delete, mark as read, or redirect messages. A rule can hide alerts or payment conversations from the account owner.
- Delegates and shared access: Check for unfamiliar people or accounts with permission to read or send mail.
- Recovery and authentication settings: Confirm that recovery addresses, phone numbers, and multifactor authentication methods are recognized.
- Connected applications: Review authorized apps and remove access that is unfamiliar or no longer needed.
Do not assume that the mailbox is safe simply because the password has changed. Ask the administrator to review relevant sign-in and audit records, if available, for suspicious access and account changes. Before removing suspicious settings or deleting messages, preserve useful details where practical, such as the setting, message, timestamp, or available log entry. Prioritize stopping ongoing access.
Find out what the account sent, received, or exposed
Review the sent, deleted, archived, and moved messages, along with the mailbox rules that could have concealed them. Identify unauthorized emails from the business account and note their recipients, subject lines, and timing. Look for requests to change payment instructions, share sensitive information, open a link, or take another unexpected action.
Have an administrator use available mail and sign-in records to determine what happened. The account owner may not see every relevant message if an intruder deleted or moved it, so include system records in the review when they are available. Keep a record of the suspected activity and the steps taken to contain it.
If coworkers, customers, or vendors received a suspicious message, warn them using a verified channel separate from the affected mailbox. Tell them not to act on the message or rely on its payment details until they have confirmed the request through a known contact method. For payment instructions, use contact information already on file rather than details supplied in the suspicious message.
If a payment may have been redirected
Handle suspected financial fraud as an urgent branch of the response. Contact your bank immediately if a payment may have been sent to the wrong account or redirected. Explain that the business email account may be compromised and share the transaction details you have. The FBI's Business Email Compromise guidance describes this type of email-enabled financial fraud and provides information about reporting it.
Preserve the related emails, payment instructions, transaction records, and communications with the bank. If you report the incident, provide the information requested through the official reporting process. Keep the account-security response and the financial-fraud response coordinated, so the team can address access while someone follows up on the payment.
Preserve records and coordinate the response
Keep a clear record of when the incident was discovered, which account was affected, who was notified, and what changes were made. Save relevant messages and available logs before they are lost, when doing so will not delay containment. Limit access to those records to the people handling the incident, and follow your organization's established procedures.
Decide who needs to be notified based on what the review finds. That may include coworkers who received messages, customers or vendors whose information or payment instructions were involved, and the people responsible for the organization's technology and business operations. Use verified contact details and keep communications factual. If the mailbox was used for account recovery or access to other systems, ask the administrator to assess those connected accounts as well.
For broader preparation, see Zevonix's small business IT security checklist and guidance on business continuity planning. Clear responsibilities and tested recovery plans can help a business respond in an organized way when technology access is disrupted.
Frequently asked questions
Should you change the password or disable the account first?
If the account is actively being misused, ask an administrator to restrict or disable sign-in where available, then reset credentials and secure recovery methods. If no administrator is immediately available, use trusted account-security controls and seek help promptly. The priority is to stop access without relying on a password change alone.
How do you stop an attacker from staying logged in after a password reset?
Ask an administrator to revoke active sessions and tokens where the system permits, then review connected applications, recovery settings, and multifactor authentication methods. The available controls vary by email system.
Should you preserve emails and logs before removing suspicious settings?
Preserve relevant messages, settings, and logs when practical, but do not delay urgent containment to collect them. Record what you can before making changes, and coordinate with the administrator handling the incident.
Who should a business notify after a compromised email account?
Notify the IT or security lead and anyone who may have acted on a suspicious message, including affected coworkers, customers, or vendors. Use a trusted alternate channel and verified contact details. If a payment may have been redirected, contact the bank immediately.
Take the next step
A focused response should secure access, check for hidden changes, identify affected recipients, and address any financial risk. If your business needs help with ongoing technology management and cybersecurity, contact Zevonix at (904) 658-0777 to discuss your needs.