Learn
Playbook
Business email compromise happens when someone gains control of a real mailbox, or impersonates one convincingly enough, to redirect a payment or steal sensitive data. If you suspect a Google Workspace mailbox has been compromised or a payment request looks off, the first hour matters more than any other part of the response: you need to verify the request out of band, lock down the account in the Admin console and preserve the evidence before it disappears. This article walks through how BEC actually plays out in Google Workspace environments, the specific warning signs to check for and a numbered first-hour checklist you can follow today.
TL;DR
BEC usually combines a lookalike domain or a genuinely compromised mailbox with a convincing invoice or payment-change request, not malware.
In Google Workspace, the clearest tells are new mail forwarding filters, unfamiliar sign-in locations, new OAuth app grants and changed account recovery details.
The first hour: verify the payment request by phone using a known number, call the bank, capture the audit logs and mailbox evidence, then force a password reset with session revocation and remove forwarding rules.
Notification obligations can include your bank, the Singapore Police Force or the FBI’s IC3, affected clients where your contracts require it and regulators: Singapore’s PDPC under the PDPA, or your supervisory authority within 72 hours where GDPR applies.
Prevention is mostly configuration: enforced 2-Step Verification, Gmail’s spoofing protections backed by SPF, DKIM and DMARC. Add a payment verification procedure that doesn’t depend on email alone.
About the Author: This article is written by the ShiftControl team. ShiftControl was built by ex-ExpressVPN operators and is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team.
How Does Business Email Compromise Actually Work?
BEC is a manipulation attack, not a malware attack. The attacker’s goal is to get someone with payment authority to move money or sensitive data to the wrong place, usually by impersonating a vendor, executive or client. The FBI describes it as a scam that often runs through legitimate business email accounts compromised by social engineering or intrusion. Attackers typically use one of two mechanisms, and the distinction matters for your response.
Lookalike domain spoofing: the attacker registers a domain that looks almost identical to a real vendor or partner (swapped letters, an extra hyphen, a different top-level domain) and sends from there. No account is actually compromised; the attacker is relying on the recipient not reading the sender address carefully.
Real mailbox compromise: the attacker gains access to an actual employee or vendor account, usually through credential phishing or password reuse, and sends from inside the real conversation thread. This version is harder to catch because the emails come from a legitimate, previously-trusted address and often reply directly into an existing thread.
Both paths tend to converge on the same outcome: an invoice with new banking details, a “confidential” request to change a vendor’s payment instructions or an urgent wire request that bypasses normal approval steps. BEC remains one of the primary financially motivated threats facing small and mid-sized businesses, with about $2.77 billion in reported BEC losses in 2024 according to the FBI’s IC3.
What Does BEC Look Like in Google Workspace Specifically?
Generic phishing-awareness advice (don’t click suspicious links) misses the operational signals that actually show up in a Google Workspace environment. If you administer Workspace, these are the specific things to check, not vague “be careful” guidance.
Unfamiliar sign-ins. Google flags suspicious sign-ins with a warning icon, and admins can search the User log events for successful and failed web-based logins from unexpected IPs or devices.
New auto-forwarding or filter rules. Attackers who gain mailbox access often create a filter that silently forwards or deletes messages matching certain keywords (like “invoice” or “wire”), so the real recipient never sees replies.
Unauthorized mailbox permission changes, such as delegate access granted to an account the user doesn’t recognize.
New or unusual OAuth app grants. A compromised account may authorize a third-party app with broad scopes, which can persist even after a password reset.
Domain-wide delegation abuse, where a service account is used to impersonate a user and access their mail or files without a normal login event.
Changed recovery phone number or email, which attackers often set first so they can regain access after being locked out.
Google Workspace gives admins the tools to check most of this directly: Admin audit logs for configuration changes, the Alert Center (phishing and malware warnings) and the security investigation tool to search for and delete malicious emails across inboxes. The investigation tool is only in Enterprise Standard/Plus, Education Standard/Plus, Frontline Standard/Plus, Enterprise Essentials Plus and Cloud Identity Premium. On Business editions, use the audit and investigation page (Reporting > Audit and investigation) and Gmail log events instead. The challenge for most small businesses is that nobody is watching the data in real time, because checking logs isn’t anyone’s full-time job.
What Should You Do in the First Hour?
Speed matters because wire transfers can often still be recovered or frozen if the bank is contacted quickly, but that window closes fast. Treat the first hour as two parallel tracks: stopping the money, and locking down the account. If the attacker is still actively using the account, suspend it immediately in the Admin console (suspension resets the user’s sign-in cookies), then continue with the steps below.
1. Verify the payment request out of band. Call the vendor or employee using a phone number you already had on file, not one in the suspicious email. This single step stops many invoice-fraud attempts before money moves.
2. Call the bank immediately if a transfer has already gone out. Ask them to flag or recall the wire. Time is the deciding factor here.
3. Capture the evidence before you change anything. Pull the Admin audit log and the mailbox’s email headers, and screenshot or export the forwarding rules, filters and connected apps. This is your evidence trail for the bank, law enforcement and any compliance notification.
4. Force a password reset and revoke all active sessions for the suspected account in the Admin console. A password reset alone doesn’t end an active session; you need to revoke sessions separately. In the Admin console, open the user, then Security > Sign-in cookies > Reset. Note that this does not sign the user out of some apps, such as Gmail and Drive for desktop.
5. Remove any suspicious forwarding rules or filters from the mailbox, after you have screenshotted or exported them. Check Settings > Forwarding and POP/IMAP, and the Filters tab, for anything the user didn’t create.
6. Revoke suspicious OAuth tokens and third-party app access tied to the account, after exporting the list of grants, since these can outlive a password change.
7. Check for domain-wide delegation abuse on connected service accounts if the organization uses custom integrations.
8. Document the timeline as you go, not after. Who found it, when, what you changed, in what order. You’ll need this regardless of what comes next.
Who Needs to Be Notified, and When?
Once the account is contained, notification is a separate track with its own deadlines. Contact your bank immediately if funds moved, since fraudulent wires can sometimes be frozen if reported quickly. Singapore readers should also report to the Singapore Police Force; US readers can file with the FBI’s Internet Crime Complaint Center (IC3).
If the incident exposed personal data, regulators may need to hear from you too. Under Singapore’s PDPA, an organization must assess a suspected data breach within 30 calendar days. If the breach is likely to cause significant harm to individuals, or affects 500 or more individuals, notify the PDPC as soon as practicable and no later than 3 calendar days after deciding it is notifiable, and notify affected individuals as soon as practicable. If GDPR applies to your organization, Article 33 requires you to notify your supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals gdpr-info.eu, and keep an internal register documenting the timeline, scope and remediation. Your contracts or customer agreements may also require you to notify affected clients, so check them, and keep a documented incident response plan and forensic evidence on hand.
This is where having an incident response plan template ready before an incident happens saves real time. Scrambling to figure out who to call while a wire is still in flight is how the first hour turns into the first week.
How Do You Prevent BEC Before It Happens?
Containment is reactive. The more useful work happens beforehand, in configuration choices that remove the easy paths attackers rely on.
Enforce 2-Step Verification org-wide, not just recommend it. Google Workspace lets admins require it at the organizational unit level.
Turn on Gmail’s spoofing and authentication protections under Apps > Google Workspace > Gmail > Safety (protection against domain and employee-name spoofing, which shows warning banners on suspicious inbound mail), and set up SPF, DKIM and DMARC for your domain.
Require phone verification for any payment or banking-detail change, independent of whatever channel the request arrived on.
Review third-party app permissions regularly, since OAuth grants are a common persistence mechanism attackers use after the initial compromise.
Disable automatic forwarding for the org unit (Apps > Google Workspace > Gmail > End User Access > Automatic forwarding), and review the user’s filters and forwarding settings during any incident.
None of this requires a dedicated security hire. It requires someone owning the configuration and checking it on a schedule, which is where small teams often fall short: nobody’s job description includes reviewing OAuth scopes.
Frequently Asked Questions
What is business email compromise (BEC)?
BEC is a scam where an attacker impersonates a trusted email sender, through a lookalike domain or a genuinely compromised account, to trick someone into sending money or sensitive data to the wrong place.
How do I know if my Google Workspace account was compromised?
Check for sign-ins from unfamiliar locations or devices in the User log events, new forwarding filters you didn’t create, unrecognized OAuth app grants and changed account recovery details.
What’s the very first thing I should do if I suspect a compromised email account?
Verify any associated payment request by phone using a known contact number, then capture the audit log and mailbox evidence, then force a password reset and revoke active sessions for the account in the Admin console.
Can I recover money sent to a fraudulent account?
Sometimes, if you contact your bank immediately and report to the Singapore Police Force (or the FBI’s IC3 for US readers). Recovery odds drop quickly the longer the transfer has had to clear.
Does Google Workspace have built-in tools to investigate BEC?
Yes. Admin audit logs, User log events, the Alert Center and, on eligible editions, the security investigation tool let admins trace sign-ins, configuration changes and malicious emails across the organization. The investigation tool is not in Business editions, where the audit and investigation page and Gmail log events cover similar ground.
Do I need a dedicated IT team to handle this?
No. The response steps above are achievable by an ops or finance lead using the Admin console directly, though having a documented cyber incident response plan and pre-arranged incident response support removes the guesswork during a live incident.
What should a small business incident response plan template include?
At minimum: containment steps (password reset, session revocation, token removal), evidence preservation steps, a notification list (bank, police or IC3, affected clients where contracts require it, regulators such as the PDPC or a GDPR supervisory authority where applicable) and clear ownership of who executes each step.
About ShiftControl
ShiftControl is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team. Google Workspace access is set up and removed automatically when someone joins, moves or leaves, and everything else runs as a guided task list for the app owner. You can see every app and OAuth scope connected to your Workspace and track SaaS spend and renewals. You can also export app assignments and authorization history as audit evidence. Cyber incident response (IR-1, via Blackpanda) is included in every subscription. ShiftControl is SOC 2 Type 2 compliant, ISO 27001 certified and signed the CISA Secure by Design Pledge in 2024. Setup takes as little as 10 minutes with a Google Workspace admin sign-in.
Start a 14-day free trial, no credit card required.
References
Identify and secure compromised accounts | Support & troubleshooting | Google Workspace Help (knowledge.workspace.google.com)
How to Prevent Business Email Compromise? | Huntress (huntress.com)
Google Workspace Account Takeover: How Admins Stop, Investigate, and Recover Compromised Accounts | Adaptive Security (adaptivesecurity.com)
Investigating Business Email Compromise (BEC): A Practical Approach | Prophet Security (prophetsecurity.ai)
Advanced security and threat prevention | Google Workspace (workspace.google.com)
Business Email Compromise, Explained - Limehawk (limehawk.io)
Business Email Compromise (ic3.gov)
2024 IC3 Annual Report | FBI (ic3.gov)
Guide on Managing and Notifying Data Breaches under the PDPA | PDPC (pdpc.gov.sg)
About the security investigation tool | Google Workspace Admin Help (knowledge.workspace.google.com)
Sign a user out of a managed Google Account | Google Workspace Admin Help (knowledge.workspace.google.com)
Set up automatic forwarding for Gmail | Google Workspace Admin Help (support.google.com)
Art. 33 GDPR – Notification of a personal data breach to the supervisory authority | General Data Protection Regulation (GDPR) (gdpr-info.eu)
