Stopping a Business Email Compromise at a 40-Person Firm

A 40-person accounting firm using Microsoft 365 Business Premium received what appeared to be a routine wire instruction change from a long-time client.

The email passed SPF, DKIM, and DMARC checks because the attacker had compromised the client's mailbox via a phishing campaign two weeks earlier. The reply-to address was subtly altered (a lookalike domain), and the request matched the client's tone and prior conversation history.

Defender for Office 365 flagged the message as "Impersonation of trusted sender" because the lookalike domain was registered only 11 days prior. The Mailbox Intelligence feature compared the sender pattern to the genuine client's historical sending behaviour and surfaced the mismatch. The accounts payable clerk saw the safety tip banner and called the client directly using a known phone number — confirming the wire change was fraudulent.

Zero financial loss. The firm reported the lookalike domain, blocked it tenant-wide, and ran a 30-minute training session for all staff using the actual incident as the example. Defender's automated investigation also surfaced two other recipients of the same campaign and quarantined their copies retroactively.