Fraud & Financial Crime
Business Email Compromise Investigations: How They Got In and Who Is Behind It
If an attacker took over or impersonated a business email account to redirect a payment or steal data, we work out how access was gained, what was exposed, and who is responsible, with evidence your bank, insurer and law enforcement can use.
- Who we helpCompanies, finance teams, insurers and legal teams
- What we examineMailboxes, domains, logs and payment instructions
- What you getForensic findings on the compromise and the attacker
- How we startFree, confidential consultation
What is a business email compromise investigation?
A business email compromise (BEC) investigation determines how an attacker got into or imitated a business email account, what they saw and changed, where the money went, and who is behind it. It is more specific than a general wire fraud investigation, which covers every kind of payment fraud. See our wire fraud investigations page for the broader picture.
Recovery is never guaranteed, and speed matters, so contact us as soon as you spot the attack.
How BEC attacks happen
The ways attackers get into the conversation
Most BEC cases involve one or more of these techniques. Our investigation identifies which one was used against you.
Account takeover
Attackers use stolen or phished credentials to log in to a real mailbox and watch for payment conversations.
Look-alike domains
A near-identical domain impersonates your company, a vendor or a customer, and emails arrive that look legitimate.
Vendor email compromise
A supplier’s mailbox is compromised, and genuine invoices are sent with changed bank details.
Executive impersonation
A fake message from a CEO or CFO pressures finance staff into an urgent payment.
How CEO fraud works →Hidden mailbox rules
Forwarding rules, delegated permissions and IMAP settings quietly copy or hide messages from the real user.
Spear phishing and malware
Targeted emails deliver credential theft pages or malware, and AI is making these messages harder to spot.
AI-powered BEC →What we do
What our BEC investigators examine
Mailbox and email forensics
We collect and analyze email trails, full headers, permissions, forwarding and IMAP settings, and sign-in logs to establish how and when the attacker got in.
Domain and infrastructure analysis
We trace look-alike domain registrations, hosting and IP addresses, and map the infrastructure behind spoofed or compromised accounts.
Attribution of the attacker
We combine open-source research, money-flow tracing and controlled engagement to identify the individuals or groups responsible.
Evidence for recovery and legal action
We prepare evidence packages and reports for banks, insurers, attorneys and law enforcement, and we provide expert testimony and litigation support if the matter goes to court. We find the evidence that helps build your case, and we can ghostwrite subpoenas for your attorney if needed.
If it just happened
What to do right now
The first steps affect both your evidence and your recovery options. Our step-by-step guide covers them in detail: what to do after a BEC attack.
- Call your bank immediately and ask for a wire recall.
- Do not delete emails or wipe the affected mailbox. Ask your IT team to preserve mailbox audit and sign-in logs first.
- Save the original emails, invoices and payment instructions, including full email headers.
- Report the attack to the FBI’s IC3 at ic3.gov and to local law enforcement.
- Notify your insurer and check your policy’s notice deadlines.
- Contact us for a confidential consultation.
Proof
What law enforcement says about our work
“We relied heavily on the Rexxfield report in writing up our justification for why we wanted to open this case as your products made it very clear that there was significant ongoing criminal conduct targeting a victim in [location redacted]. Also to Rexxfield’s credit, the complex frauds unit at [location redacted] was eager to open based in part on your work.”
FBI field agent (name redacted) · Case RX3817001
“After reviewing your team’s findings, I can confirm that they align with the results of my own investigation. Your analysis reinforces the direction of our ongoing work and provides valuable corroboration for the data we’ve developed internally.”
Task Force Officer, U.S. Secret Service Cyber Fraud Task Force · Case RX153836711075
Feedback from individual agents. Rexxfield is a source, not a law enforcement agent. The FBI and U.S. Secret Service do not officially endorse Rexxfield or its products. See a real example: our business email compromise case study.
Questions
BEC investigation FAQ
What is a business email compromise investigation?
It is a forensic investigation into how an attacker took over or impersonated a business email account. It establishes how access was gained, what the attacker saw and changed, where payments went, and who is behind the attack, and it documents the findings for banks, insurers, attorneys and law enforcement.
How is a BEC investigation different from a wire fraud investigation?
BEC is one specific type of wire fraud, driven by compromised or impersonated email. A BEC investigation focuses on the email side: mailboxes, domains, logs and the attacker’s infrastructure. Our wire fraud investigations cover every kind of payment fraud, including invoice fraud, real estate fraud and romance scams.
Can you identify who is behind a BEC attack?
Often we can identify the accounts, infrastructure and, in many cases, the people behind the attack, using open-source research, technical analysis, money-flow tracing and controlled engagement. Some records can only come from a bank or platform through a court process. We are not a law firm, but we work with attorneys and support litigation when a case needs it.
What evidence should I preserve?
Keep the original emails with full headers, mailbox audit and sign-in logs, any forwarding or inbox rules, the invoices and payment instructions involved, and the bank’s wire confirmations. Do not delete messages or wipe or rebuild the mailbox before the evidence is saved.
Can stolen funds be recovered after a BEC attack?
Sometimes, but never with a guarantee. Recovery depends on how fast the bank is contacted, where the funds went, and the quality of the evidence. A bank recall alone often fails, and a documented investigation gives banks and law enforcement something concrete to act on. Our BEC by the numbers report covers the scale of the problem.
Who investigates your case
Rexxfield’s team includes Stephen Dougherty, a former U.S. Secret Service investigator with more than 15 years in cybercrime and wire fraud; Ronnie Tokazowski, our CTO and a threat-intelligence researcher with more than 15 years of experience; and Anna Hulst, a licensed private investigator with more than 10 years of experience specializing in OSINT and social engineering. Meet the full team.
Related: Wire fraud investigations · Digital asset tracing · Litigation support · Case studies
Hit by business email compromise?
Speak with an investigator. The consultation is free and confidential.
Contact Our TeamLast updated: October 15, 2026. Rexxfield is a cyber-investigations firm, not a law firm. This page is general information, not legal advice.