How do business email accounts usually get taken over?

Phished passwords, passwords reused from a breached service, and missing MFA — in that order. MFA plus a password manager removes nearly all of this risk.

Business email account takeover

5 min readReviewed October 2026 · Internet Safety Australia Editorial Team

In short

Email takeover = invoice fraud, banking resets and customer scams in one package.
Regain access, evict the attacker (sessions, forwarding rules, MFA), then check what they touched.
Tell affected contacts quickly — silence lets the attacker keep trading on your name.

When criminals take a business email account, they don’t announce it — they read. They learn your invoicing rhythm, your suppliers, your tone. Then they strike: redirected invoices sent from your real address, password resets on your banking, scam emails to your customers that pass every sniff test because they’re genuinely from you.

Spot it early

Sent items you didn’t write; rules auto-forwarding mail to unknown addresses.
Password-reset emails you didn’t request; login alerts from strange locations.
Clients replying to emails you never sent, or asking about “your new bank details”.

Hour-by-hour response

Regain and reset
Reset the password from a clean device; if locked out, use your provider’s admin/recovery process. Reset every account that used the same password.
Evict the attacker
Sign out all sessions, remove unknown forwarding rules and delegates, revoke app passwords, and turn on MFA (authenticator app, not just SMS).
Assess the damage
Check sent items and rules for the takeover period; list who was emailed and what financial details may have been exposed.
Notify and report
Warn contacts who received fake mail (especially about bank details), report to ReportCyber (1300 CYBER1), call IDCARE for support, and consider OAIC obligations if personal information was exposed.

Common questions

Where to report this

Report to ReportCyber

Cybercrime: identity theft, online fraud, hacked accounts or devices, ransomware and online threats.

1300 CYBER1 (1300 292 371)

Go to ReportCyber

Report to OAIC

Privacy complaints and data breaches involving your personal information held by organisations or agencies.

1300 363 992

Go to OAIC

Official sources for this guide

cyber.gov.au — business email compromise (leaves our site — official service)

Reviewed October 2026 by Internet Safety Australia Editorial Team. Internet Safety Australia is independent and not a government website.