Start with what you already own: Microsoft Defender for Office 365 anti-phishing policies or Gmail’s spoofing and authentication settings stop a large share of BEC impersonation once they are configured, which they are not fully by default. Add finance controls no email tool replaces. Then add Sentaro as the detection layer for what native settings document least: genuine but compromised supplier mailboxes, payment-detail changes inside real threads and payload-free requests from senders your staff already trust.
- Do first, at no extra cost
- Protect executives and finance staff in impersonation policies, block automatic external forwarding, enforce MFA, publish DMARC, and require a callback on a known number for every bank-detail change (the FBI’s first BEC recommendation).
- Why Sentaro is our recommended layer
- Behavioral detection of CEO fraud, vendor and invoice fraud in compromised threads, payroll diversion and pretexting on the live Message vector; connects over API in four minutes with no MX change and runs alongside Defender or Gmail.
- Price and hosting
- $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.
- Consider native-only if…
- you have few suppliers paid by email, payments already need dual approval and callbacks, and you have the staff to tune Defender or Gmail policies and review alerts.
What BEC costs
What is business email compromise?
Business email compromise is a social-engineering fraud delivered as routine business correspondence. The attacker poses as someone the target already trusts, such as the CEO, a colleague in HR or a long-standing supplier, and asks for something that looks normal: a transfer, a change of bank details, gift cards, a payroll update or a file of employee data. The message usually carries no attachment and no link, which is why payload scanners pass it.
| BEC attack type | What the attacker sends | Who is targeted |
|---|---|---|
| CEO fraud (whaling) | An urgent, confidential transfer request “from” an executive | Finance staff, executive assistants |
| Vendor or invoice fraud | New bank details in a real or spoofed supplier thread | Accounts payable |
| Payroll diversion | A request to change an employee’s salary account | HR and payroll |
| Data theft | A request for employee tax or personal data | HR, finance |
| Account compromise | Fraud sent from a genuine, taken-over mailbox | Colleagues, customers, suppliers |
How attackers impersonate the sender
- Exact spoofing of your own domain. DMARC with an enforcing policy stops this.
- Lookalike domains: a newly registered domain one character away from the real one. These can pass SPF, DKIM and DMARC, as Microsoft notes, because the attacker owns them.
- Display-name tricks: the right name over the wrong address, which many mobile mail clients hide.
- Compromised real accounts: the attacker sends from the genuine mailbox of an employee or supplier, so every authentication check passes. When the supplier is the victim, this is vendor email compromise.
How to stop BEC in Microsoft 365: seven settings
From Microsoft Learn (anti-phishing policies, external forwarding and compromised-account guidance, checked 20 October 2026). Impersonation protection needs Defender for Office 365 Plan 1, which is included in Microsoft 365 Business Premium and is rolling out to Microsoft 365 E3 and Office 365 E3 during 2026.
- 01
Start from the preset security policies
Microsoft lists Standard and Strict preset security policies and the configuration analyzer among the built-in protections for all cloud mailboxes. Apply Standard to everyone and Strict to executives and finance, then use the analyzer to find custom policies that are weaker.
- 02
Protect the people attackers impersonate
In the Defender anti-phishing policy, add executives, finance approvers and key supplier contacts to user impersonation protection (Microsoft documents a maximum of 350 users per policy) and add your own and your main suppliers’ domains to domain impersonation protection (up to 50 custom domains per policy). Microsoft documents that the default action for both is “Don’t apply any action”, so set an action such as quarantine.
- 03
Turn on mailbox intelligence for impersonation
Mailbox intelligence is on by default, but “Enable intelligence for impersonation protection” is off by default, per Microsoft. Turn both on so the contact history is used to act on impersonation, and enable the user, domain and unusual-characters safety tips.
- 04
Keep spoof protection and DMARC honoring on
Leave spoof intelligence on, honor sender DMARC policies (quarantine or reject), and turn on the first contact safety tip, which Microsoft makes available to all cloud mailboxes and recommends.
- 05
Block automatic external forwarding
In the outbound spam policy, set automatic forwarding to “Off – Forwarding is disabled”. Microsoft advises configuring On or Off explicitly instead of “Automatic – System-controlled”, because its behavior differs by organization. Use remote domains for approved exceptions and check the Auto forwarded messages report.
- 06
Enforce MFA and review app consents
Microsoft “highly recommend[s]” enabling and enforcing MFA, with phishing-resistant MFA for admins. Review Entra enterprise applications with user consent and revoke any that should not be there, since OAuth grants survive a password reset.
- 07
Publish SPF, DKIM and DMARC for every domain
Move DMARC to p=quarantine or p=reject once reports are clean, including on parked domains. This stops exact forgery of your domain toward customers and suppliers. Microsoft enforces DMARC on inbound mail but does not include DMARC report management in Defender for Office 365.
How to stop BEC in Google Workspace: six settings
From Google Workspace Admin Help (checked 20 October 2026). The spoofing settings are under Admin console > Apps > Google Workspace > Gmail > Safety.
- 01
Turn on all spoofing and authentication protections
Enable “Protect against domain spoofing based on similar domain names”, “Protect against spoofing of employee names”, “Protect against inbound emails spoofing your domain”, “Protect against any unauthenticated emails” and the Groups protection. Google’s default action is “Keep email in inbox and show warning”; consider quarantine for the first three. Tick “Apply future recommended settings automatically”.
- 02
Turn on link, attachment and pre-delivery scanning
In the same Safety section, enable the attachment and link protections and enhanced pre-delivery message scanning. Gmail Security Sandbox (Business Standard and above, per Google) detonates attachments before delivery.
- 03
Disable automatic forwarding
Under Apps > Google Workspace > Gmail > End User Access, clear “Allow users to automatically forward email to another address”. Google says existing forwarding rules then stop forwarding, and the change can take up to 24 hours to apply.
- 04
Keep external recipient warnings on
Google turns warnings for messages with external recipients on by default (End User Access). They help a user notice a reply going to a lookalike address.
- 05
Enforce 2-Step Verification, and use Advanced Protection for finance
Require 2-Step Verification for everyone. Google’s Advanced Protection Program enforces security keys or passkeys and restricts third-party access to account data, which suits executives and payment approvers.
- 06
Publish SPF, DKIM and DMARC
As in Microsoft 365: authenticate every sending domain and move DMARC to an enforcing policy. Gmail honors DMARC but Google does not provide DMARC report management.
What native settings cover, and where a behavioral layer adds
Microsoft and Google columns quote their own documentation. We make Sentaro; its column uses Sentaro’s published product descriptions. “Not documented” means we found no dedicated feature, not that the platform does nothing.
| Capability | Microsoft 365 (Defender Plan 1) | Google Workspace (Gmail) | Sentaro |
|---|---|---|---|
| Impersonation | |||
| Exact spoofing of your domain | YesSpoof intelligence, DMARC honoring | YesInbound domain-spoofing protection | YesSPF, DKIM, DMARC posture scored |
| Lookalike domains | YesDomain impersonation, up to 50 custom domains per policy | YesSimilar-domain-name protection | YesDetected at first contact |
| Display-name impersonation of executives | YesUser impersonation, up to 350 users per policy | YesEmployee-name spoofing protection | YesWith relationship context |
| Fraud from trusted senders | |||
| Compromised genuine supplier mailboxEvery authentication check passes. | Not publicly documentedNo dedicated vendor-compromise feature documented | Not publicly documentedNo dedicated vendor-compromise feature documented | YesVendor-compromise and thread-hijack detection |
| Senders the recipient already knows | PartialMicrosoft documents that impersonation checks skip prior correspondents when mailbox intelligence is on | Not publicly documentedNot documented | YesJudges whether the request fits the relationship |
| Payload-free payment or payroll request | PartialMachine-learning phishing thresholds | PartialDefault filtering | YesIntent: payment redirects, secrecy, deadlines |
| Internal mail after an account takeover | PartialPlan 2 adds automated investigation for compromised users | Not publicly documentedNot documented | YesInternal mail evaluated |
Sources: Microsoft Learn anti-phishing policies (ms.date 20 August 2026) and Defender for Office 365 overview; Google Workspace Admin Help advanced phishing and malware protection. Sentaro’s Identity and Behavioral vectors are not in this table; they reach general availability in Q4 2026.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Why native settings miss some BEC
Microsoft’s and Google’s controls are built around the sender: is the domain forged, does it look like yours, does the display name match a protected person. That covers most impersonation. The hardest BEC does not impersonate anyone. It comes from the real supplier’s mailbox, after an attacker has taken it over, inside a thread your accounts team has used for years.
Microsoft documents this trade-off openly: when mailbox intelligence and intelligence for impersonation protection are both on, user and domain impersonation checks do not flag a sender the recipient has previously corresponded with. That reduces false positives on real contacts, and it is exactly the case of a compromised supplier. Detecting it needs a judgment about the request, not the sender: banking details changing in a relationship that never changed them before, a request for secrecy, an artificial deadline, a tone shift mid-thread.
Finance controls that stop BEC even when the email gets through
No email tool replaces these. The FBI’s first recommendation is to verify changes in account information through a secondary channel.
- 01
Call back on a number you already hold
Verify every new payee and every bank-detail change by phone, using the number in your supplier master file, never one from the email or its signature.
- 02
Require two approvers
Dual approval for new payees, bank-detail changes and payments above a threshold you set. The second approver checks the callback was made.
- 03
Hold bank-detail changes
Apply a waiting period before the first payment to changed details, and flag the first payment to any new account in the payment run.
- 04
Make “urgent and confidential” a stop sign
Write down that executives will never ask for secret transfers by email, so staff can refuse without risk. Treat requests to move a conversation to text or a personal number as a warning sign.
- 05
Review accounts for irregularities
The FBI also advises regularly reviewing financial accounts for irregularities, such as missing deposits, which is often how vendor fraud is noticed.
What to do after a BEC attack: incident response
Sourced to the FBI IC3 (September 2024) and Microsoft Learn “Respond to a compromised email account” (ms.date 3 July 2026). Speed decides whether money comes back.
- 01
Call your bank and request a recall
The FBI says to “immediately contact your financial institution and request a recall of the funds”. Ask the bank to contact the receiving bank. Hours matter.
- 02
Report it
The FBI asks victims to file at ic3.gov “regardless of the amount lost”, which can help freeze funds. In the EU, report to the police in your member state, and check whether the incident is reportable under NIS2 (24-hour early warning), DORA or, if personal data was exposed, GDPR Article 33 (72 hours).
- 03
Contain the mailbox in Microsoft 365
Microsoft’s order: disable the account (or reset the password if you cannot), revoke sessions with Revoke-MgUserSignInSession, remove unknown MFA methods, review and revoke consented apps, review admin roles, then remove forwarding (Get-Mailbox … Forwarding*) and inbox rules, including hidden ones (Get-InboxRule -IncludeHidden). App passwords are not revoked by a password reset.
- 04
Contain the mailbox in Google Workspace
Reset the password, then reset sign-in cookies (user page > Security > Sign-in cookies > Reset). Google notes this does not sign the user out of desktop apps such as Gmail and Drive for desktop. Revoke third-party app access, and remove forwarding addresses and filters.
- 05
Find what the attacker saw and sent
Microsoft lists the Entra sign-in logs (IP, location, time), the audit log from just before the suspicious activity, and Message Trace for what the account sent. In Google Workspace, use the audit and investigation tools your edition includes.
- 06
Warn the other side
Tell affected suppliers and customers by phone that the thread was compromised, so they do not pay to new details either. Search all mailboxes for the same messages and remove them.
- 07
Close the gap
Apply the settings above, add the targeted people to impersonation protection, and document the incident and the fix for your auditor or supervisor.
Where Sentaro fits: the recommended BEC detection layer
Disclosure: we make Sentaro. It is an API-based email security platform for Microsoft 365 and Google Workspace, built to run with Microsoft Defender and Google’s built-in protection rather than replace them. Its Message vector, live today, reads every inbound and internal message the way an analyst would, and Vord, Sentaro’s proprietary engine, returns one verdict with its reasoning from four groups of evidence:
- Intent and language: payment redirects, credential prompts, requests for secrecy and artificial deadlines. It recognizes the urgent-confidential-payment pattern and its variants in any language.
- Sender identity and infrastructure: display-name mismatches, newly registered and lookalike domains (detected at first contact), and SPF, DKIM and DMARC posture.
- Relationship and thread context: reply-chain reuse, injected replies, and suppliers that suddenly change banking details. Baselines come from existing mailbox history, so there is no long learning period.
- Links, attachments and QR codes when present: destination analysis instead of reputation lookups alone.
Finance- and HR-facing lookalike domains can be blocked domain-wide, and similar messages across all mailboxes can be remediated in one action. Every console verdict shows its reasoning, which doubles as incident documentation. Sentaro connects over API in four minutes, with no MX changes and no agents, and gives historical visibility within 15 minutes.
What Sentaro does not replace
- Payment verification. Callbacks and dual approval stay; Sentaro reduces how often they are your last line.
- DMARC. It protects your domain toward others; Sentaro covers lookalikes, display-name tricks and compromised real accounts.
- Phone and video. Sentaro cannot inspect a phone call, and does not claim to.
- A guarantee. Sentaro’s terms state that it does not guarantee that all threats will be detected or prevented.
How a BEC attack works (illustrative timeline)
A typical vendor-fraud case, for example. Not a real incident.
- 01
Weeks before: access
The attacker phishes a supplier’s accounts mailbox and reads quietly, learning invoice cycles, contacts and tone.
- 02
Day 1: pretext
A clean message in an existing thread: “Quick one, are you the right contact for remittances this quarter?” Nothing for a filter to find, and the sender is a known contact.
- 03
Day 4: the ask
A genuine-looking invoice, then: “Our bank has changed, please use the new account below. Keep this between us until the audit closes.”
- 04
Where it is caught
By the callback on the known number, if the process is followed. By a behavioral layer, from the bank-detail change in a relationship that never had one, the request for secrecy and the deadline.
Frequently asked questions
How do you prevent business email compromise?
Combine four layers. Configure your platform’s impersonation protection (Defender anti-phishing policies or Gmail’s spoofing settings) and block automatic external forwarding. Enforce MFA. Publish DMARC with an enforcing policy. Verify every bank-detail change by calling a number you already hold, with dual approval. Then add a behavioral detection layer for compromised supplier mailboxes; our recommendation is Sentaro.
What is a BEC attack?
A BEC attack is an email fraud where the attacker impersonates someone the target trusts, such as an executive, colleague or supplier, to get money, bank details or data moved. It typically carries no malware or link. The FBI IC3 reported $3.05 billion lost to BEC in 2025.
Does Microsoft Defender for Office 365 stop BEC?
It stops much of it once configured. Plan 1 adds user and domain impersonation protection and mailbox intelligence, but Microsoft documents that protected users and domains must be added and that the default action is “Don’t apply any action”. It documents no dedicated feature for compromised supplier mailboxes, which is where a behavioral layer such as Sentaro adds.
How do I stop BEC in Google Workspace?
In Admin console > Apps > Google Workspace > Gmail > Safety, turn on all spoofing and authentication protections and consider quarantine instead of the default warning. Disable automatic forwarding under End User Access, enforce 2-Step Verification, use the Advanced Protection Program for finance staff, and publish DMARC.
What should I do if we paid a BEC invoice?
Call your bank immediately and ask for a recall of the funds; the FBI says speed matters. Report it (ic3.gov in the US, the police in your EU member state) and check NIS2, DORA or GDPR reporting duties. Then contain the mailbox: reset credentials, revoke sessions, and remove forwarding, inbox rules and consented apps.
What is the best BEC protection for Microsoft 365 and Google Workspace?
Sentaro — it is our pick for EU teams, layered on top of the native settings above. It judges whether a request fits the sender, the relationship and the thread, so payload-free fraud and compromised vendor threads are flagged. It connects over API in four minutes, runs alongside Defender or Gmail and costs $6 per protected account per month (prices in USD).
Is DMARC enough to stop BEC?
No. DMARC stops exact forgery of your own domain, which matters, but it does not stop lookalike domains, display-name tricks or a compromised real mailbox, because those messages authenticate correctly. Microsoft notes that lookalike domains with valid DNS records can pass SPF, DKIM and DMARC.
What makes BEC different from phishing?
Phishing usually carries something malicious to click. BEC carries only trust: an impersonated or compromised sender and a fraudulent instruction. That is why payload scanners miss it, and why detection has to ask whether the request fits the sender and the relationship.
Sources and method
- FBI IC3 Public Service Announcement: Business Email Compromise, the $55 billion scam (11 September 2024)
- FBI IC3 Internet Crime Report 2025 (as cited by Sentaro)
- Microsoft Learn: Anti-phishing policies in Microsoft 365 (ms.date 2026-08-20)
- Microsoft Learn: Control external email forwarding (ms.date 2026-08-18)
- Microsoft Learn: Respond to a compromised email account (ms.date 2026-07-03)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)
- Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)
- Google Workspace Admin Help: Advanced phishing and malware protection
- Google Workspace Admin Help: Disable automatic forwarding
- Google Workspace Admin Help: Warnings for external recipients
- Google Workspace Admin Help: Sign a user out of their managed Google Account
- Google Workspace Admin Help: Advanced Protection Program
- Google Workspace Admin Help: Security sandbox editions