Account takeover slips past email filters because the login is real. See the sign-in and mailbox signals worth alerting on, and the right order to respond.
Email account takeover means an attacker logs into a real mailbox and uses it. Because the login is real and the messages come from a trusted account, content filters see nothing wrong. Catching it means watching the login and the mailbox, not only the message. The money is real. The FBI received 24,768 business email compromise complaints in 2025, with $3.05 billion in reported losses.
Most email security judges what a message contains. It looks for bad links, bad files, and known bad senders. But an account takeover gives it none of those. The sender is a real colleague or supplier, the message is plain text, and it often continues an existing thread.
The FBI’s 2025 Internet Crime Report shows the scale. Business email compromise cost $3,046,598,558 in reported losses. Ransomware, by comparison, cost $32,320,105. Business email compromise is quieter than ransomware, yet it costs far more.
The attacker’s logic is simple: why break in when you can log in? A stolen login skips the malware, the exploit, and the filter.
An account takeover usually follows the same steps. Each step leaves a different trace.
| Stage | What happens | Where it shows up |
|---|---|---|
| Steal the login | Phishing, an infostealer, or a fake login page captures access | Sign-in logs |
| Log in | The attacker signs in from a new place or device | Sign-in logs |
| Hide | The attacker creates rules that move or delete replies | Mailbox settings |
| Watch | The attacker reads threads and learns who pays whom | Mailbox audit logs |
| Strike | A payment or banking change request goes to real contacts | Sent items, and the recipient’s judgment |
The first two stages often start with credential harvesting. The later ones happen inside a trusted account, so detection has to move from the message to the behavior around it.
Discover how Threatcop protects your workforce from modern cyber threats.
Microsoft documents several sign-in risk detections in Entra ID Protection. Four are useful for catching an email account takeover.
| Signal | What it means |
|---|---|
| Atypical travel | Two sign-ins from distant places, where at least one is unusual for that user |
| Unfamiliar sign-in properties | A sign-in with an IP, location, or device the user has not used before |
| Anonymous IP address | A sign-in from a source such as Tor or an anonymous VPN |
| Anomalous token | A session token with unusual characteristics |
Treat these as prompts, not verdicts. Microsoft notes that some detections produce false positives, especially at low and medium risk levels. So combine signals. A new device alone is common. A new device, an anonymous IP, and a new inbox rule an hour later is not.
The mailbox shows what the attacker does once inside. Likewise, Microsoft documents a detection for suspicious inbox rules that delete or move messages. That is a classic hiding move.
Watch for these changes:
Turn on mailbox auditing first. Without logs, nobody can later say what an attacker read. A secure email gateway or an API-based tool can also see internal mail that never crosses the perimeter.
When a signal looks real, act in a fixed order. Speed matters, because the attacker may already be writing to your contacts.
Signals catch many takeovers, but they will not catch all of them. A careful attacker uses a familiar device and writes in the right tone. At that point, the best sensor is a person who notices that a request does not fit.
Threatcop Phishing Incident Response (TPIR) turns that doubt into action. Staff report a suspicious message in one click from email or WhatsApp, and can check its threat level before they decide. TPIR then runs header analysis, link and file scanning, an IP reputation check, and fake domain checks in a sandbox.
TPIR’s “Who Else” insight shows which other mailboxes received the same message. That matters for account takeover, because the attacker usually writes to many contacts at once. Genuine mail returns to the inbox, and TPIR deletes malicious mail. So one person’s report can protect everyone the account reached.
If you can do only a few things this quarter, start here.
None of these needs a new product. Together, they close the gaps attackers rely on most, and each one also helps you investigate quickly if an account is ever taken over. Review the list every quarter, because attackers change tactics and your own mailbox settings drift over time.
Account takeover works because the attacker looks like someone you trust. So stop relying on message content alone. Alert on the login signals Microsoft documents, watch for new inbox rules, and turn on mailbox auditing. Follow a fixed response order, starting with revoking sessions. Then make sure staff can report a request that feels wrong in one click. Filters judge messages, logs judge behavior, and people judge whether a request makes sense. You need all three to catch an attacker who logs in rather than breaks in, and the order in which you build them matters less than building all three.
Email account takeover is when an attacker gains access to a real email account and uses it to read mail, send messages, or commit fraud. The messages come from a trusted address, so they often pass filters that judge only message content.
Business email compromise is the fraud, usually a request to move money. Account takeover is one way to carry it out. Some BEC attacks use spoofed domains instead. Many of the most convincing ones use a real hijacked account. Real examples appear in these BEC attack examples.
Watch sign-ins and the mailbox together. Alert on atypical travel, unfamiliar devices, anonymous IP addresses, and new inbox rules that delete, move, or forward mail. Combine signals, because any one of them can be harmless. Staff reports add a human check that tools miss.
After an email account takeover, revoke active sessions and tokens, then reset the password and require MFA again. After that, remove malicious rules and forwarding, review sent items, and warn contacts who received requests. A password reset alone may leave a stolen session open.
MFA helps against email account takeover, but the type matters. CISA says not all forms of MFA are equally secure. Some are open to phishing, push bombing, and SIM swapping. Phishing-resistant MFA, such as hardware keys and passkeys, gives much stronger protection.
Shikha Mishra is responsible for driving the growth and adoption of TDMARC, a flagship product of Threatcop, across India, the Middle East, APAC, and the UK region. With her expertise, she helps organizations safeguard their domains so that no hacker can misuse them to send fraudulent emails, thereby protecting both their brand and reputation. She is passionate about enabling businesses to simplify the complexities of outbound email security through TDMARC’s comprehensive solution, allowing them to stay focused on what matters most to their success.
Phishing redirectors forward chosen victims to a hidden credential page, and AiTM kits relay your MFA. See how the...
AI code is flawed in nearly half of tested tasks, and developers are targets too. See how to train...
Help desk impersonation, fake booking-site emails, and vendor risk drive travel cyber losses. See the patterns, the MGM figures,...
