Home›Incident Response›Business email compromise
Section
Account takeover, token theft, and BEC investigations.
A business email compromise where the decisive evidence wasn't the foreign sign-in or the inbox rule — it was an MFA device the user swore she never enrolled.