Phishing & Email-Fraud Runbook (free) — IncidentReady

Phishing & Business Email Compromise (BEC) Triage

Purpose: Triage a reported phish or a suspected account takeover fast enough to stop credential theft, inbox-rule persistence, and payment fraud before money moves.

Open this runbook when… - A user reports “I clicked a link” or “I think I entered my password somewhere I shouldn’t have.” - Multiple people report the same suspicious email (a phishing campaign against your org). - Finance reports a payment or wire that looks off, was redirected, or a vendor says they never received a payment you sent. - You spot an inbox rule you didn’t create (auto-forward, auto-delete, or rules moving mail to unusual folders). - A user’s sent folder shows emails they don’t recognize sending. - A colleague or customer says they got a weird email “from you” that you didn’t send.

Severity quick-set

Severity Definition Example for this incident type
S1 — Critical Credentials confirmed entered on a phishing site AND account shows signs of active misuse, or a fraudulent payment was sent User entered M365 password on fake login page; inbox rule auto-forwarding to external address found; wire transfer sent based on spoofed vendor email
S2 — High Click confirmed but credentials NOT entered, or credentials entered but no misuse detected yet User clicked a link, closed the page immediately, no login page appeared; or password entered but caught within minutes, no suspicious sign-ins yet
S3 — Moderate Phishing email reported but not clicked/opened, or a low-confidence “this looks weird” report User forwarded a suspicious email to IT without clicking anything; email flagged by filter and quarantined automatically

When in doubt about whether credentials were entered, treat as S1 — the cost of an unnecessary password reset is far lower than a live BEC.

First 15 minutes

  1. Get the facts from the user in plain language, fast: Did you click a link? Did a login page appear? Did you type your password? Did you open an attachment and enable content/macros? Did you reply with any information?
  2. If credentials were entered anywhere: disable the account immediately (don’t just reset the password — disable sign-in, then reset). See 03-compromised-account.md for the full account-lockdown sequence.
  3. If an attachment was opened or macros enabled: isolate that device from the network (same as ransomware Step 1 — pull network/Wi-Fi, don’t power off) and treat it as a potential malware entry point.
  4. Force sign-out of all active sessions for the affected account the moment it’s disabled — a disabled account can still have live sessions until tokens are revoked (see 03-compromised-account.md, “Session revocation”).
  5. Check for inbox rules immediately — this is the #1 BEC persistence artifact and takes under 2 minutes to check. See Investigation section for exact paths.
  6. If this involves a payment, invoice, or wire transfer: call your bank’s fraud line NOW, before doing anything else in IT. Wire recalls have a narrow window — minutes and hours matter far more here than the technical response. Bank fraud line: [[BANK_FRAUD_PHONE]].
  7. Do not reply to, forward, or interact further with the phishing email. Preserve it — do not delete it from the user’s mailbox yet, IT needs the headers.
  8. Get the full email headers from the reporting user (see Appendix for how) and save them to the incident log.
  9. Warn anyone else likely to have received the same phish — check if it was a targeted single send or a campaign (see Investigation, “Was this targeted?”).
  10. Start the incident log — who, what, when, what was clicked/entered, what actions taken and at what timestamp.

Containment

Investigation

User reports suspicious email
        │
        ▼
Did they click the link?
   │NO                 │YES
   ▼                    ▼
Quarantine email    Did a login page appear
(S3, log & done)    asking for credentials?
                        │NO                │YES
                        ▼                   ▼
                   Isolate device      Did they enter
                   if attachment       credentials?
                   opened; monitor         │NO             │YES
                   (S2)                    ▼                ▼
                                      Monitor account   DISABLE ACCOUNT NOW
                                      for 24-48h (S2)   Reset password,
                                                         revoke sessions,
                                                         hunt for inbox
                                                         rules (S1)

Inbox-rule hunting — the #1 BEC artifact

Attackers create rules that auto-forward or auto-delete mail (especially anything mentioning “invoice,” “payment,” “wire,” or the bank’s name) to hide their tracks while they wait for a financial transaction to intercept. Check this on EVERY suspected account compromise, not just ones with obvious symptoms.

Microsoft 365: - Admin: Exchange admin center → Mail flow → Rules (org-wide rules) AND Recipients → Mailboxes → [user] → Mail flow settings → Manage email forwarding (per-mailbox forwarding). - Per-mailbox inbox rules: Exchange admin center → Recipients → Mailboxes → [user] → Manage mailbox permissions, or run in PowerShell: Get-InboxRule -Mailbox user@domain.com. - Also check: Entra admin center → Applications → Enterprise applications, and Microsoft 365 Defender → Email & collaboration → Explorer to trace mail flow around the incident window.

Google Workspace: - Admin console → Apps → Google Workspace → Gmail → User settings, or have the user check Gmail → Settings → Filters and Blocked Addresses directly. - Admin console → Reporting → Audit and investigation → Gmail log events, filter by the user, look for Create filter or Change filter events in the suspected window. - Check delegate access: Admin console → Reporting → Gmail log events, filter for Grant delegate access.

Any forwarding rule to an external domain, any filter deleting/archiving mail with financial keywords, or any rule the user doesn’t recognize = treat as confirmed compromise (S1), regardless of what the user initially reported.

Was this targeted or a campaign?

Mailbox audit steps (for any account with confirmed or suspected compromise)

  1. Review sign-in history for the account: unfamiliar IPs, countries, or impossible-travel patterns.
  2. Review sent items and drafts for anything the user didn’t send — attackers often draft-and-send while inside a compromised mailbox.
  3. Review mailbox permission changes (delegates, “send as” grants) in the same audit logs above.
  4. Review OAuth app grants for the account (see 03-compromised-account.md, “OAuth grant review”) — a common BEC technique is granting a malicious app persistent mailbox access that survives a password reset.
  5. Check calendar for new meeting invites or shares the user didn’t create — sometimes used for further social engineering.

Payment-fraud stop procedures

If any invoice, wire, or ACH payment may have been influenced by this incident (redirected bank details, spoofed vendor email, urgent payment request):

  1. Call your bank’s fraud/wire-recall line immediately — before finishing IT containment steps. Time is the deciding factor: domestic wires often have a same-day recall window; ACH has a slightly longer but still narrow window (typically within 24–48 hours, bank-dependent). International wires are hardest to recall — call anyway. Bank fraud line: [[BANK_FRAUD_PHONE]], Account contact: [[BANK_CONTACT]].
  2. Provide the bank: transaction date/time, amount, recipient account/routing number, and state clearly it is suspected fraud so they invoke recall procedures, not a standard dispute.
  3. Contact the real vendor/counterparty via a phone number from a prior invoice or your own records — NOT any number in the suspicious email — to confirm their actual bank details and warn them their identity may be spoofed against you (or that their own mailbox may be compromised, if the request came from their real address).
  4. File a complaint with IC3.gov (FBI) — for BEC-driven wire fraud specifically, the FBI’s Recovery Asset Team can sometimes intercept funds if reported within 72 hours. This is time-sensitive; don’t wait until full investigation is complete.
  5. Notify [[FINANCE_LEAD]] to place a hold on any other pending payments to the same vendor until verified.
  6. Loop in [[CYBER_INSURER_PHONE]] — many policies cover social-engineering/funds-transfer fraud as a distinct claim category from the general cyber policy; confirm what’s covered.

Eradication and recovery

  1. Confirm the account is fully secured: password reset, MFA re-enrolled from a clean device, all sessions revoked, all unrecognized inbox rules/forwarding/delegates removed, all unrecognized OAuth grants revoked.
  2. Re-scan any device involved (link click, attachment open) with current AV/EDR; reimage if malware is confirmed or if you can’t be certain it’s clean.
  3. Search the entire mail environment for the phishing message and purge or quarantine remaining copies:
  4. Block the sender domain/address and any malicious URLs at the email gateway and (if available) web proxy/firewall.
  5. If credentials were reused elsewhere (personal email, other SaaS tools), advise the user to change those passwords too — reused passwords are the most common secondary damage path.
  6. Re-verify no persistence remains: re-check inbox rules and OAuth grants one more time 24–48 hours after remediation, since some attacker tooling re-adds rules if any residual token/session survived.

Communications

Internal - Notify [[IT_LEAD]] immediately on any S1/S2. Notify all staff if it’s a campaign (multiple recipients) so others can self-report without embarrassment — normalize reporting, don’t shame the clicker. - Finance/[[FINANCE_LEAD]] notified immediately on anything payment-related, in parallel with the bank call, not after.

Customers / vendors - If a vendor’s identity was spoofed to target you, or your compromised account was used to target your customers/vendors, notify them directly by phone (not email, in case their mailbox is also compromised) so they can watch for the same attack.

Cyber insurer - Notify [[CYBER_INSURER_PHONE]] for any confirmed BEC with financial loss, or any confirmed credential compromise of a privileged account — check policy terms for notification deadlines.

Law enforcement - File with IC3.gov for any BEC involving attempted or successful funds transfer — do this within 72 hours if possible to preserve Recovery Asset Team eligibility. - Local police report may be needed for insurance claims even if federal recovery isn’t likely.

Regulatory - If the compromised mailbox contained regulated data (health, financial, PII) and was accessed/exfiltrated, standard breach-notification analysis applies. State laws vary — not legal advice; consult counsel on notification obligations.

Exit criteria

This incident is closed when:

Post-incident review

Hold within 48 hours. Attendees: [[IT_LEAD]], affected user’s manager, [[FINANCE_LEAD]] if payment-related.

  1. What made this phish convincing (urgency, spoofed sender, familiar branding, timing around a real transaction)?
  2. How long between click/entry and containment? What slowed detection or response?
  3. Was MFA in place on the account? If yes, how was it bypassed (real-time phishing proxy, MFA fatigue, legacy auth protocol)? If no, why not?
  4. Did email filtering catch or miss this, and is a rule/policy tuning needed?
  5. What’s the one training or technical control that would have stopped this, and who owns implementing it?

Appendix: copy-paste templates

Staff phishing-campaign alert

Subject: Phishing Alert — Do Not Click

We’ve identified a phishing email circulating with the subject line “[[SUBJECT]]” from sender “[[SENDER]].” Do not click any links or open attachments in this email. If you already have, contact [[IT_LEAD]] immediately at [[IT_LEAD_PHONE]] — no judgment, just report it fast. If you received it and haven’t interacted with it, forward it to [[PHISHING_REPORT_ADDRESS]] and delete it.

Vendor/customer identity-spoof warning

Subject: Security Notice — Possible Email Impersonation

We want to alert you that [[COMPANY]] identified an email impersonating [[US/THEM]] on [[DATE]], attempting to redirect payment or extract credentials. If you received an unusual payment-change request or login prompt claiming to be from us recently, please do not act on it and call us directly at [[VERIFIED_PHONE]] to confirm before taking any action.

Bank fraud-line call script

“I’m calling to report suspected wire/ACH fraud on account [[ACCOUNT_NUMBER]]. A payment of $[[AMOUNT]] was sent on [[DATE]] to [[RECIPIENT ACCOUNT/ROUTING]] based on a fraudulent email. I need to request an emergency recall and want to flag this as fraud, not a standard dispute.”

IC3.gov BEC report — information to have ready

How to get full email headers

Useful commands / checks

# M365 PowerShell: list inbox rules for a mailbox
Get-InboxRule -Mailbox user@domain.com | Select Name,Enabled,ForwardTo,RedirectTo,DeleteMessage

# M365 PowerShell: list mail forwarding config for a mailbox
Get-Mailbox -Identity user@domain.com | Select ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward

# M365 PowerShell: revoke all sessions/tokens for a user
Revoke-AzureADUserAllRefreshToken -ObjectId <user-object-id>