A finance address appears in exposure evidence during a busy invoicing period. The finding does not prove that anyone entered the mailbox or altered a payment. It does justify asking who owns the account and which business decisions depend on it.
Technical containment and financial verification are related workstreams. Neither should wait for the other to explain its responsibilities.
Separate the finding from the fraud claim
The FBI's business-email-compromise guidance describes fraud involving messages that appear to come from trusted business contacts. A suspicious payment request can involve impersonation without a confirmed mailbox takeover.
Document exactly what is known: an exposure record, unusual sign-in, changed mailbox setting, disputed message, or payment instruction. Do not turn those different observations into one unsupported story.
A hypothetical finding for [email protected] should lead to an account-ownership review, not an automatic announcement that customer billing was compromised.
Review the account through authorized tools
Use the email provider's response guidance to check access, registered authentication methods, relevant sessions, delegation, and mailbox changes. Microsoft's compromised-account guidance provides one provider-specific example.
Preserve relevant records according to the incident plan. Do not copy complete mailbox contents or credential values into a broad incident chat.
If current unauthorized access is suspected, the identity and messaging teams should coordinate containment and verify what each administrative action affects.
Give finance its own decision path
Ask whether any payment details, supplier instructions, or customer-facing messages need independent confirmation. Use an established contact method, not a new phone number included in the disputed request.
A legitimate urgent invoice can still follow the verification process. The control is about authorizing the financial action, not deciding whether the sender sounds convincing.
Where a transfer may already have been affected, involve the organization's finance and incident leads promptly. Follow the established banking and reporting procedures rather than relying on a technical ticket alone.
Close the business question too
A completed response should distinguish account containment, reviewed mailbox activity, payment verification, and unresolved impact. “Password reset” is one action, not a verdict on all four.
Review the workflow afterward: who may approve changed bank details, who receives exposure alerts for high-impact accounts, and whether a substitute is available when the usual approver is absent.
Read shared-mailbox access ownership and lookalike domains versus exposed accounts. Good response language prevents both complacency and an unsupported claim that every unusual invoice came from a breached mailbox.