Business email compromise can affect payments, customer trust, supplier conversations and personal data. Treat it as more than a password problem.
Prepared and reviewed by IT Life-Raft
UK-based IT support and cyber recovery guidance. Last reviewed September 2026.
Pause payments and supplier bank-detail changes until verified by a known number. Keep evidence before deleting rules or messages.
If you've been hacked, start with our step-by-step recovery checklist. It explains what to secure first, how to protect your email and accounts, what evidence to keep, and what to do next.
Recovery checklistIf this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
Keep the order simple: contain the issue, recover control, then strengthen the account or device so the attacker cannot return.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Check cyber insurance, incident response duties and whether the ICO 72-hour breach reporting clock may apply if personal data is at risk.
If money, customer data, Microsoft 365, business email or a website is involved, get advice before wiping evidence or assuming the issue is closed.
These links help confirm the official recovery route. Use them alongside the checklist, especially when account recovery, fraud reporting or business data may be involved.
It is when an attacker gains access to, or convincingly imitates, a business email account to redirect money, data or trust.
If personal data may have been exposed, assess the breach promptly. Some incidents must be reported within 72 hours.
Use a safe alternative route until the compromised account and related mailboxes have been checked.
Tell us what happened, what is affected and whether money, customer data or business systems may be at risk.