BEC Investigation Runbook

Immediate Banking Actions

1. Contact Sending Bank (Your Institution)
   • Call treasury contact or fraud hotline immediately
   • Reference specific wire transfer details (amount, date, reference number)
   • Request immediate recall and account freeze
   • Provide incident report number
   • Request confirmation of recall attempt
2. Contact Receiving Bank (if known)
   • Report fraudulent transfer to receiving institution
   • Request beneficiary account freeze
   • Provide law enforcement case number (if available)
3. Freeze Additional Accounts (if compromise suspected)
   • Temporarily suspend online banking access for compromised users
   • Place alerts on all corporate accounts
   • Require dual approval for all outgoing wires

Compromised Account Actions

1. Immediately Reset Password
   • Force password change for compromised account
   • Revoke all active sessions and tokens
   • Disable account temporarily if investigation requires
   • Document original password hash for forensics
2. Remove Suspicious Email Rules and Forwarding
   • Check for auto-forwarding rules to external addresses
   • Remove inbox rules that delete or move emails
   • Document all rules before deletion (screenshot)
   • Check for calendar sharing with external accounts
3. Preserve Mailbox for Forensics
   • Create complete mailbox export/backup before changes
   • Enable litigation hold to prevent auto-deletion
   • Capture audit logs for last 90 days
   • Document compromised account activities

Internal Notifications

• Finance Department Alert

  Immediately notify all finance staff to halt processing of any pending wire transfers or payment changes. Implement verbal verification for all payment requests until further notice.

• Executive Team Notification

  Inform C-suite that impersonation attack is in progress. Request they verify legitimacy of recent payment or data requests they may have made.

• IT Help Desk Brief

  Update help desk on incident details to field potential related reports. Provide guidance on identifying similar attempts.

External Communications

• Vendor/Customer Notification (if applicable)

  If attacker impersonated your organization to external parties, notify affected vendors/customers of potential fraudulent communications. Provide verification procedures.

• Payment Processor Alert

  Notify payment processors (payroll, AP systems) of potential compromise. Request enhanced verification on account changes.

Primary Account Investigation

Lateral Movement Detection

Check if attacker accessed other accounts after initial compromise:

Shared Credential Analysis

• Check for password reuse across services:

  If compromised password was reused for other corporate services (VPN, cloud apps, etc.), those accounts may also be compromised.

• Review password manager access:

  If user's password manager was accessed, all stored credentials are potentially exposed.

• Check MFA bypass methods:

  Review if attacker registered new MFA devices or used legacy authentication protocols that bypass MFA.

Mailbox Content Analysis

Email Forwarding and Export Detection

Initial Access Vector Identification

Persistence Mechanism Review

Attackers establish persistence to maintain access even after password changes:

External Communication Review

• Identify external recipients of fraudulent emails:

  Search sent items for emails to external domains during compromise window. These organizations may have been targeted as secondary victims.

• Vendor relationship impact:

  If attacker impersonated your organization to vendors, they may have provided fraudulent payment instructions or requested sensitive data.

• Customer communication compromise:

  Review if customer-facing accounts were compromised. May result in customer data exposure or reputational damage.

Sending Bank (Your Institution)

1. Call treasury management or fraud department immediately

   Do not rely on email alone. Use phone for immediate action. Have your account manager and fraud hotline numbers readily available.

2. Provide complete wire transfer details
   • Account number funds were sent from
   • Wire transfer amount
   • Date and time of transfer
   • Wire reference/confirmation number
   • Beneficiary bank name and location
   • Beneficiary account number (if known)
   • Beneficiary name
3. Request immediate wire recall

   Ask bank to initiate recall through SWIFT network or ACH reversal. Get confirmation that recall request was sent and reference number for tracking.

4. Request account freeze if compromise suspected

   If you suspect attacker has online banking access, request temporary freeze on additional outgoing wires and ACH transfers.

Receiving Bank (Beneficiary Institution)

1. Contact fraud department directly

   Search for receiving bank's fraud hotline. Identify yourself as victim of wire fraud and request immediate account freeze.

2. Provide fraud documentation
   • Your company's wire transfer authorization
   • Fraudulent email with headers
   • Law enforcement case number (if available)
   • Proof of your authority to request freeze
3. Request beneficiary account freeze

   Ask receiving bank to place hold on beneficiary account to prevent withdrawal or transfer of fraudulent funds.

File FBI IC3 Report Immediately

1. Go to ic3.gov and file online complaint

   IC3 accepts reports 24/7. File immediately even if details are incomplete. You can supplement with additional information later.

2. Select "File a Complaint"

   Choose appropriate complaint type - select "Business Email Compromise" category explicitly.

3. Complete all required fields

   Provide as much detail as possible. Incomplete reports delay processing.

4. Save IC3 complaint number immediately

   You will receive IC3 complaint number upon submission. This is critical for all future correspondence.

5. Request FBI RAT (Recovery Asset Team) involvement

   For transfers over $50,000, explicitly request RAT intervention in your complaint. RAT can contact beneficiary banks within hours to freeze accounts.

Local Law Enforcement Report

File report with local police or sheriff's department in addition to FBI:

• • Provides additional case number for documentation
• • Required by some insurance policies
• • Creates official police record for legal proceedings
• • May be required for international cooperation

Note: Local police may have limited BEC investigation capabilities but report is still valuable for documentation and insurance purposes.

International Law Enforcement (if applicable)

For international wire transfers, additional agencies may assist:

SWIFT Tracking (International Wires)

• • SWIFT messages can be recalled if not yet credited to beneficiary account
• • Intermediary banks can place holds if notified promptly
• • Each bank in chain can be contacted to freeze funds
• • FBI RAT has direct SWIFT contacts for expedited freezes

Domestic Wire Tracking (ACH/Fedwire)

Domestic wires move faster but have some recovery mechanisms:

• Fedwire (same-day settlement):

  Real-time gross settlement system. Recall must happen within hours before beneficiary withdraws funds. Contact receiving bank fraud department immediately.

• ACH (2-3 day settlement):

  Longer settlement window provides more time for recall. Your bank can submit ACH reversal request if fraud detected before settlement.

Secondary Beneficiary Accounts

Sophisticated attackers quickly move funds through multiple accounts:

Work with FBI and receiving bank to identify downstream accounts. Each transfer provides new opportunity for freeze/recovery.

Cyber Insurance Claims

1. Notify insurance carrier immediately

   Most policies require notification within 24-72 hours of discovery. Late notification may result in claim denial.

2. Document all losses comprehensively
   • Wire transfer amounts and dates
   • Bank statements showing debits
   • Wire confirmation receipts
   • Any recovered amounts
   • Investigation costs (forensics, legal fees)
   • Business interruption losses
3. Preserve all evidence

   Do not delete emails, logs, or documentation. Insurance adjusters will want to review original evidence.

4. Cooperate with insurance investigation

   Insurers may conduct their own investigation. Provide requested documentation promptly and completely.

Financial Loss Documentation Checklist

Tax Implications and Financial Reporting

Consult with accounting and tax advisors regarding BEC losses:

• • Theft losses may be tax deductible (consult tax advisor)
• • Recovered funds may have tax implications
• • Financial statement disclosure requirements (public companies)
• • SEC reporting obligations for material losses

Email Rules and Forwarding Removal

OAuth Application and Consent Removal

Mailbox Delegation and Permission Removal

MFA Device and App Password Cleanup

Password Reset Procedure

1. Admin-initiated password reset (do not use self-service)

   IT should reset password directly to prevent attacker intercept of reset emails.

2. Generate strong, unique password
   • Minimum 16 characters (recommend 20+)
   • Mix of uppercase, lowercase, numbers, symbols
   • Not based on personal information or dictionary words
   • Never reused from other accounts
   • Use password manager for generation and storage
3. Deliver password securely to user

   Use phone call, SMS, or in-person delivery. Never send via email to potentially compromised inbox.

4. Require immediate password change at first login

   Set temporary password that user must change on first sign-in to password only they know.

MFA Re-registration

Require users to re-register MFA from scratch after compromise:

Session and Token Revocation

This forces all devices and applications to re-authenticate, ensuring attacker sessions are terminated.

Account Re-enablement Checklist

When to Consider Mass Reset

• Widespread credential exposure: Company credentials found in major breach database
• Domain controller compromise: Attackers gained access to Active Directory or password hashes
• Lateral movement detected: Multiple accounts compromised with unclear scope
• Persistent re-compromise: Accounts continue to be compromised after individual resets

Mass Password Reset Planning

Enhanced Alert Configuration

Daily Review Procedures

Security team should review the following daily for 30 days post-incident:

• • Authentication logs for previously compromised accounts
• • Inbox rules and forwarding configurations
• • OAuth app consents and API permissions
• • Outbound wire transfer requests (finance team coordination)
• • External email traffic patterns
• • User-reported suspicious emails (increased vigilance)

Required Participants

• • IT Security / Incident Response Lead
• • Finance / Accounting (if wire transfer involved)
• • HR (if employee data or payroll involved)
• • Legal Counsel
• • Executive Sponsor (CFO, CIO, or CISO)
• • Affected Department Managers
• • External Forensic Investigators (if engaged)