Business Email Compromise (BEC) is the “no malware required” crime. An attacker doesn’t need to encrypt your files or drop a payload if they can get into (or convincingly impersonate) the right inbox. From there, it’s social engineering with receipts: fake invoices, “urgent” wire changes, payroll redirects, gift-card scams, and vendor-payment reroutes.
The good news: the best BEC defenses are mostly configuration and process. You’re trying to do three things at once:
1) Make account takeover hard (phishing-resistant MFA, kill legacy auth).
2) Make impersonation obvious (anti-phishing/anti-impersonation, external sender tagging).
3) Make spoofing fail (SPF/DKIM/DMARC) and alert when anything weird happens.
Microsoft’s overview of email authentication in Microsoft 365 and how signals are used to evaluate inbound mail.
Part 1: Baseline controls that matter in both Microsoft 365 and Google Workspace
Require phishing-resistant MFA (not just “any MFA”)
If you do only one thing, do this: require MFA for every user (especially finance, executives, admins) and prioritize phishing-resistant methods like security keys / passkeys where possible. Modern digital identity guidance strongly favors phishing-resistant authenticators because attackers can proxy or trick users into handing over one-time codes.
Practical rule: security keys/passkeys for admins and finance, and at least strong MFA everywhere else.
Block legacy authentication and “basic auth” paths
Attackers love old protocols because they bypass modern sign-in protections. If your environment still allows older IMAP/POP/SMTP auth patterns for user logins, clamp down. Move to modern auth only, and make exceptions rare, documented, and time-limited.
Stop auto-forwarding exfiltration
One of the most common BEC “post-login” moves is creating inbox rules or external forwarding to siphon conversations and reset links. Your policy should default to: no external auto-forwarding, and alerts when forwarding rules appear.
Turn on log/audit visibility and alerting
BEC is an incident-response race. You want rapid detection of: suspicious sign-ins, MFA resets, new OAuth grants, mailbox-rule changes, and vendor-payment conversations suddenly shifting tone.
Part 2: Microsoft 365 hardening checklist (Exchange Online + Entra ID)
1) Use Security Defaults or Conditional Access (and prefer Conditional Access at scale)
Microsoft’s small-business guidance highlights using Security Defaults for a fast baseline, and Conditional Access when you need granular policies (device compliance, location risk, role-based controls).
Recommended Conditional Access patterns:
Require MFA for all users; require stronger methods for admins; block sign-ins from risky locations; require compliant devices for high-risk roles.
2) Configure anti-phishing and impersonation protection
In Microsoft 365, anti-phishing policies can detect impersonation and spoofing, and Microsoft notes that anti-phishing protections rely on authentication signals like SPF/DKIM/DMARC. Defender for Office 365 adds more advanced spoof intelligence.
High-impact settings to prioritize:
Enable impersonation protection for executives and finance, strengthen mailbox intelligence, and quarantine (not “move to junk”) for high-confidence impersonation attempts.
3) Implement SPF, DKIM, and DMARC (in the right order)
Microsoft’s email and collaboration security guidance recommends configuring SPF, then DKIM, then DMARC for all custom domains (including parked domains/subdomains).
How to roll it out without breaking mail:
Start DMARC at p=none to collect reports, fix legitimate senders, then move to p=quarantine, then p=reject once you’re confident. CISA also recommends validating and monitoring SPF/DKIM/DMARC implementation and refining policies over time.
Goal state: DMARC policy at reject for your primary domain, with strict alignment where feasible.
4) Tighten external sender experience
BEC thrives on “this looks internal.” Add clear external sender indicators and consider warning banners for first-time senders or domains that resemble yours. Train staff to treat payment changes as a second-channel verification event, not an email thread.
5) Protect admin roles and admin consent
Admin accounts should use phishing-resistant MFA and separate “daily use” vs “admin” identities. Monitor and restrict app consent (OAuth) so attackers can’t persist via a “helpful” third-party app grant.
Part 3: Google Workspace hardening checklist (Gmail + Admin Console)
1) Enforce strong 2-Step Verification (and move power users to security keys/passkeys)
Google Workspace supports multiple authentication methods; for BEC resistance, aim higher than “SMS codes.” Push users toward stronger factors (security keys/passkeys) and lock down recovery pathways to prevent attacker-driven MFA resets.
2) Deploy SPF and DKIM, then DMARC
Google’s Admin Help notes that senders should set up DKIM and/or SPF to help prevent impersonation and message tampering in transit.
Then implement DMARC. Google’s DMARC guidance explains that DMARC tells receiving servers what to do when mail fails SPF/DKIM (reject/quarantine/deliver) and provides reporting to spot abuse.
Same rollout approach: DMARC none → fix sources → quarantine → reject.
3) Strengthen Gmail phishing and spoofing defenses
Google’s security documentation describes layered protections including spam/phishing/malware filtering and spoofing prevention, plus strong access controls like security keys and SSO.
In Admin Console, prioritize: tighter attachment policies, link protections where available, suspicious message warnings, and stricter controls for high-risk groups (finance/executives/vendor-management).
4) Restrict external forwarding and suspicious mailbox behavior
As with Microsoft 365, stop auto-forwarding by default and alert on new routing rules. Add monitoring for unusual login locations, impossible travel events, and sudden spikes in sent mail.
Part 4: The “money-move” controls BEC hates most
Payment-change verification (non-technical, extremely effective)
BEC succeeds when email becomes the approval system. Don’t let it.
Minimum process control: any request to change bank details, payment instructions, payroll direct deposit, or vendor remittance must be verified out-of-band (known phone number, vendor portal, or a previously established contact path—not the number in the email).
Protect “high value targets” with higher friction
Executives, finance, HR, and IT admins get stricter policies: phishing-resistant MFA, tighter conditional access, reduced forwarding, and more aggressive quarantine thresholds.
Part 5: A quick “secure email setup” launch plan
Week 1: Enforce MFA, block legacy auth, disable external auto-forwarding, and turn on alerts/audit visibility.
Week 2: Deploy anti-impersonation protection (exec/finance), strengthen quarantine actions, and roll out external sender tagging.
Weeks 3–4: Implement SPF → DKIM → DMARC; start at p=none, review reports, then move toward quarantine/reject
Ongoing: Tabletop BEC drills, vendor change verification enforcement, and monthly review of DMARC reports + sign-in anomalies.