In short
Email account takeover is when an attacker gains access to a real business mailbox, usually through credential phishing, stolen session tokens or tricking a user into approving a sign-in. Signs include unfamiliar inbox rules, forwarding to outside addresses and unusual sign-ins. Prevention combines phishing-resistant MFA, sign-in policies, forwarding controls and account takeover detection.
Get a quote for email account takeover protection
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is email account takeover?
Account takeover (ATO) is the compromise of a genuine account. For email, that means an attacker can read, send and delete mail as a real member of staff in Microsoft 365 or Google Workspace.
A taken-over mailbox is valuable because:
- Messages from it pass SPF, DKIM and DMARC and arrive in existing threads, so recipients trust them
- The attacker can read conversations about payments, contracts and suppliers before acting
- It can be used to phish colleagues, customers and suppliers, spreading the compromise
- The same sign-in often opens files, chat and other cloud apps
Account takeover is the source of many of the most damaging BEC attacks and invoice fraud cases.
How business mailboxes are taken over
The common routes in are:
- Credential phishing: a fake Microsoft or Google sign-in page captures the password; see phishing protection
- Session token theft: an adversary-in-the-middle phishing page relays the real sign-in, including a one-time code, and steals the session cookie, so traditional MFA does not stop it
- MFA fatigue: repeated sign-in prompts until a user approves one to make them stop
- Password reuse and leaked credentials: a password exposed in another breach works on the business account
- Consent phishing: a user is tricked into granting a malicious app access to their mailbox, which survives a password reset
- Legacy sign-in methods: older protocols that do not support modern authentication
Signs a mailbox has been taken over
Attackers try to stay hidden while they watch and wait. These are the signs administrators and users should look for:
- Inbox rules that move, mark as read or delete messages, often containing words such as invoice, payment or bank
- Forwarding to an external address, set on the mailbox or through a rule
- Sign-ins from unexpected countries, unfamiliar devices or two places too far apart to travel between in the time
- New MFA methods or app consents the user does not recognise
- Sent items the user did not write, or replies from contacts to messages the user did not send
- Microsoft 365 alerts such as "User restricted from sending email" or "Suspicious email sending patterns detected"
- Google Workspace alert centre alerts such as "Suspicious login", "Leaked password" and "Suspicious programmatic login"
Is email account takeover protection the right fit for you?
We will check it against your systems and requirements and recommend the right option.
First steps for an administrator
If you suspect a mailbox has been taken over, act in this order and keep notes as you go:
- Reset the password and revoke all active sessions, so stolen session tokens stop working.
- Review the account's MFA methods and remove any the user does not recognise.
- Remove suspicious inbox rules, forwarding and delegated access.
- Review and revoke app consents the user did not knowingly grant.
- Check sign-in and audit logs to understand when access began and what was read or sent.
- Find and remove phishing sent from the account to colleagues, and warn external contacts through a channel they already trust.
- Decide whether a personal data breach has occurred; under UK GDPR, a reportable breach must be reported to the ICO within 72 hours of becoming aware of it.
- If money has been lost, contact your bank and report it to Report Fraud, or to Police Scotland in Scotland.
If you have an IT provider or a vendor-run response service, involve them early.
Preventing email account takeover
Prevention starts with identity, then adds detection for what gets past it:
- Phishing-resistant MFA: passkeys or FIDO2 security keys cannot be relayed by a fake sign-in page; at minimum, use number matching rather than simple approve prompts
- Sign-in policies: in Microsoft 365, Conditional Access can require compliant devices or block risky locations; in Google Workspace, enforce 2-Step Verification
- Block legacy sign-in methods that bypass modern authentication
- Control forwarding: restrict automatic forwarding to external addresses and alert on new forwarding rules
- Limit app consent: require administrator approval before users grant apps access to mail
- Account takeover detection: products that watch sign-ins, mailbox rules and sending behaviour and can suspend or flag a compromised account
Our sister site covers the identity side in depth: identity security and identity threat detection and response.
Products with account takeover detection
These are the email products we supply that the vendors describe as detecting account takeover:
| Product | Account takeover capability (from vendor material) | Mail platforms the vendor lists |
|---|---|---|
| IRONSCALES | Account takeover protection included in Email Protect Pro and Complete Protect, or added to Email Protect | Microsoft 365 for account takeover protection; email protection also covers Google Workspace |
| Check Point Email Security | Account takeover detection; a Leaked Credentials add-on is listed | Microsoft 365, Google Workspace |
| FortiMail Workspace Security (formerly Perception Point) | Anti-BEC and account takeover layer for compromised Microsoft 365 accounts | Microsoft 365 for account takeover; email protection also covers Google Workspace |
| Acronis Email Security | Account takeover protection that blocks credential phishing and uses machine learning to watch for unusual account behaviour, plus outbound scanning of Microsoft 365 mail | Microsoft 365, Google Workspace and others |
| TrendAI Vision One Email and Collaboration Security | Account takeover detection included from the Core tier | Microsoft 365, Google Workspace |
Coverage can differ by mail platform and plan, so we confirm what applies to yours at quote. For the wider comparison, see email security platforms compared.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How we help
We can help you reduce the risk of mailbox takeover and spot it sooner. We can:
- Review MFA, sign-in policies, legacy authentication, app consent and forwarding settings in Microsoft 365 or Google Workspace
- Recommend, license and deploy an email product with account takeover detection, with package contents confirmed at quote
- Help you write a short response checklist for your team or IT provider
Ask us for a quote: Contact us about protecting against email account takeover.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is email account takeover?
Email account takeover is when an attacker gains access to a genuine business mailbox and uses it to read mail, send fraudulent messages, redirect payments or phish others. Because the account is real, its messages pass authentication checks.
How does account takeover happen?
Most often through credential phishing, stolen session tokens from adversary-in-the-middle phishing pages, MFA fatigue prompts, reused or leaked passwords, or a user granting a malicious app access to their mailbox.
How do I know if my business email account has been hacked?
Look for inbox rules or forwarding you did not create, sign-ins from unfamiliar places or devices, new MFA methods, sent messages you did not write and contacts replying to emails you did not send. Your administrator can check sign-in and audit logs.
What should I do if a work email account is compromised?
Tell your IT team straight away. They should reset the password, revoke sessions, remove unknown MFA methods, rules, forwarding and app consents, review logs, warn contacts and decide whether a breach must be reported to the ICO.
Does MFA stop email account takeover?
MFA stops most password-only attacks, but some phishing kits steal session tokens or rely on users approving prompts. Phishing-resistant methods such as passkeys and FIDO2 keys, plus account takeover detection, close more of the gap.
Still have a question about email account takeover protection?
Ask us and a member of our team will reply by email.