iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act as though the attacker still has access until you revoke sessions, remove persistence, and verify the logs. Use a trusted device and a communication channel outside the affected mailbox, contain the account, invalidate tokens, inspect forwarding and rules, investigate what was accessed or sent, then re-enroll phishing-resistant multifactor authentication (MFA). A password change by itself does not remove an attacker who has a live session, stolen refresh token, malicious OAuth consent, forwarding rule, or added authentication method.
This procedure applies to Microsoft 365 and to other business email systems with equivalent controls. Your identity provider’s labels and retention periods may differ, so have an administrator or incident-response professional perform the actions and preserve evidence.
What to do in the first hour
Do not use the compromised mailbox to coordinate recovery. The attacker may read those messages, impersonate you, or delete evidence. Call your IT or security team, manager, bank, and affected partners from a known-clean phone or account instead.
- Move to a trusted device and network. Use a device that your security team considers clean. If the computer or phone used to open the phishing link might contain malware or a token-stealing implant, disconnect it from business systems and follow your organization’s incident-response process.
- Scan before changing credentials. Microsoft Support’s recovery guidance calls for a current, full antivirus scan before changing or resetting a password. If responders determine that malware or token theft is possible, reimage the endpoint rather than trusting a scan alone. Changing a password on an infected device can immediately expose the new password.
- Use an administrator-controlled path. Ask a separate administrator to disable the affected account while the investigation starts. Microsoft says disabling a compromised account is preferred and highly recommended until the investigation is complete. If disabling is not available, have the administrator reset the password through a trusted management channel; never send the new password by email.
- Record the likely compromise window. Note when the link was opened, when unusual sign-ins or messages appeared, and when the account was contained. Investigators can use that interval to focus sign-in, audit, and message records.
If the account controls payroll, customer records, payment instructions, or regulated information, treat the event as a business incident rather than a routine password reset. Preserve logs and involve legal, privacy, and insurance contacts according to company policy.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Contain the identity without destroying evidence
Disable first when your platform permits it
Disabling the user blocks normal sign-in while responders examine the account. It also gives the team time to collect evidence before the attacker can continue operating. Do not delete the user, mailbox, or audit records during this stage; deletion can remove information needed to determine what happened.
Reset the password through a trusted administrator
If a reset is necessary, perform it from a clean administrator workstation or identity-management console. Generate a unique password that has never been used elsewhere. Do not reuse a personal password, share it in chat, or email it to the employee. Deliver it through your organization’s approved secure method, or have the administrator complete the sign-in setup directly.
Separate the user’s device from the account decision
A clean account does not make an unsafe endpoint trustworthy. Keep the suspected device isolated until a full scan, forensic review, or reimage is complete. The account can be recovered from a separate device while the original endpoint is examined.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRevoke every path the attacker can use
After containment, invalidate both credentials and active authentication state. Ask the identity administrator to complete each applicable item, then document the time and operator.
- Revoke active sign-in sessions. Sign-out or session revocation forces currently authenticated browsers and apps to authenticate again. A password change may not terminate every existing session.
- Revoke refresh tokens. Refresh tokens can let an attacker obtain new access without entering the password again. Explicit token revocation is therefore a separate action from resetting the password.
- Rotate exposed secrets. Change API keys, app passwords, shared secrets, or other credentials that were visible in the mailbox or on the compromised endpoint. Treat any secret stored in sent mail, drafts, attachments, or cloud notes as exposed.
- Re-enroll authentication only after cleanup. Remove unknown authenticators first. Re-adding a trusted method before deleting the attacker’s method can leave both parties able to approve a sign-in.
Record which sessions, tokens, passwords, and secrets were revoked. If your provider reports that a particular token type cannot be revoked immediately, keep the account disabled and escalate to the provider or incident-response team.
Remove persistence hidden in account settings
Attackers commonly create a way back in before they leave. Review the following settings for every affected mailbox and for any administrator account involved in recovery. Compare each item with the employee’s known devices, applications, and job duties.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
MFA devices and authentication methods
List every registered phone, authenticator application, security key, passkey, recovery email, and backup method. Remove anything the owner and administrator cannot identify. Check the registration time and recent use when those details are available. After removal, enroll the employee’s verified methods from a clean device.
Free tools Windows power users keep installed
One-click scans. No signup required.
OAuth application consent
Review applications that have permission to read mail, send mail, access files, or maintain offline access. Revoke unfamiliar grants and any grant created during the compromise window. A malicious application can retain access even after a password reset because it uses its own authorization token.
Mailbox forwarding and transport changes
Inspect external forwarding addresses, forwarding rules, inbox rules, and any organization-level mail-flow changes associated with the user. Remove destinations that are not approved. Check both visible settings and administrative controls; an attacker may forward a copy of every incoming message while leaving the mailbox looking normal.
Inbox, deleted-item, and automatic-reply rules
Look for rules that hide messages, mark them read, move them to obscure folders, delete replies, or trigger automatic responses. Include hidden rules and rules that target words such as “invoice,” “wire,” “payment,” or “password.” Review automatic replies for altered bank details or instructions that redirect correspondents.
Delegates, roles, and group membership
Remove unknown mailbox delegates and calendar delegates. Review directory roles, privileged assignments, shared-mailbox access, distribution-group membership, and application administrator roles. An attacker who added a second account or elevated a group may still have access after the original user’s password is changed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Investigate what the attacker accessed or sent
Recovery is incomplete until you understand the impact. Have an administrator export or preserve relevant records before retention periods expire. The exact event names and retention windows depend on your service plan and configuration.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Sign-in and identity audit logs
Search the compromise window for successful and failed sign-ins, unfamiliar IP addresses, impossible travel, new devices, unusual user agents, MFA changes, password resets, consent grants, role changes, and session revocations. An unfamiliar location is a lead, not proof by itself: mobile networks, VPNs, and corporate gateways can make legitimate activity appear distant. Correlate sign-in events with the employee’s travel and device records.
Mailbox audit and message trace
Review sent mail, drafts, deleted items, and message trace for messages the user did not create. Search for new recipients, external forwarding, replies to payment conversations, and bulk mail. Preserve message headers and timestamps when possible; they help distinguish a forged display name from a message actually sent through the account.
Data access and exfiltration
Determine whether the attacker opened or downloaded attachments, searched mail, accessed cloud files, or used the mailbox to reset other services. Pay special attention to customer data, contracts, employee records, credentials, and payment instructions. Record the affected data categories, recipients, and time range for legal or regulatory assessment.
Recommended Free Tools
Business email compromise indicators
Check for requests to change bank details, rush a wire, buy gift cards, alter payroll, or keep a transaction secret. Contact the employee’s customers and suppliers through known telephone numbers or previously verified channels, not numbers supplied in the suspicious message.
Notify people and report financial fraud quickly
Warn internal and external contacts
Tell staff not to trust recent messages, links, attachments, or payment instructions from the account until you provide an all-clear. Notify customers, suppliers, and other recipients who received suspicious mail. Use a separate, trusted address or phone number and explain how to verify future requests. Do not forward the malicious message to large groups if doing so could execute links or expose sensitive content; your security team can distribute safe indicators instead.
Contact the financial institution immediately
If a wire, payment, payroll change, or account-number request was involved, call the bank’s fraud team at a verified number. Ask whether a recall, hold, or beneficiary alert is possible. Speed matters, and waiting for the email investigation to finish can reduce the chance of recovery.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Report business email compromise
Report payment-related business email compromise to the FBI’s Internet Crime Complaint Center (IC3) and follow your organization’s legal and insurance procedures. Preserve the original messages, headers, invoices, transfer details, and call records for the report.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Harden the account after the investigation begins
Choose phishing-resistant MFA
Once the account is clean, enroll a method that resists fake sign-in pages. CISA advises businesses to aim for phishing-resistant MFA. Microsoft identifies FIDO2 security keys, passkeys, and Windows Hello for Business as examples. These methods bind authentication to the legitimate site or device instead of relying solely on a code that a phishing page can relay.
| Control | Phishing resistance | What it protects | Recovery and management considerations |
|---|---|---|---|
| Password reset alone | Does not address stolen sessions, tokens, or consent | The password only | Must be combined with session and persistence cleanup; administrative recovery details are not stated in the guidance |
| Password plus conventional MFA | Improves security but may still be phished or relayed, depending on the method | Sign-in to services that enforce it | Review every registered method and backup path; provider-specific management and loss recovery are not stated |
| FIDO2 security key | Phishing-resistant | The identity-provider sign-in and services that support the key | Keep an approved spare or documented recovery process; exact compatibility and logging depend on the identity provider |
| Passkey | Phishing-resistant | Supported identity-provider sign-ins | Plan recovery for lost devices and verify support across the organization’s devices; provider-specific details are not stated |
| Windows Hello for Business | Phishing-resistant | Supported Windows and identity-provider sign-ins | Requires organizational configuration and a recovery path if the device is lost; exact requirements vary by deployment |
Choose among these controls using six questions: Is it resistant to the phishing method you experienced? Can administrators enroll, disable, and audit it centrally? What happens if the authenticator is lost? Does it work with your identity provider and critical applications? Do logs show registration and use? Does it protect only the mailbox, or also the wider identity and endpoint? Document at least two trusted recovery options without leaving an unmonitored fallback method enabled.
Protect the wider identity and endpoint
Mail is often the reset channel for other services. Review password-reset addresses, single sign-on applications, cloud storage, payroll, customer-management systems, and administrator accounts that use the same identity. Remove reused passwords and rotate secrets exposed in messages or files. Keep endpoint protection current and require security staff to approve a reimage when token theft or malware cannot be ruled out.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to tell whether the attacker is really out
Use an evidence-based checklist rather than relying on a successful login. Mark an item complete only when an administrator or responder can show the relevant record.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- The endpoint used for the phishing link was scanned and, when required, reimaged or otherwise cleared by responders.
- The affected account was disabled during investigation or reset through a trusted administrator path.
- Active sessions and refresh tokens were revoked, and exposed secrets were rotated.
- Unknown MFA devices, recovery methods, OAuth consents, delegates, roles, and group memberships were removed.
- Forwarding addresses, automatic replies, visible and hidden inbox rules, and mail-flow changes were reviewed.
- Sign-in, audit, and message-trace records show no unexplained activity after containment.
- Sent, deleted, and draft folders were checked, and recipients of suspicious messages were warned.
- Payment, data-theft, legal, privacy, and regulatory decisions were assigned and documented.
- Trusted phishing-resistant MFA was enrolled and its recovery process was tested.
Keep heightened monitoring for a period defined by your incident-response policy. Reopen the investigation if a new unfamiliar sign-in, forwarding change, consent grant, automatic reply, or unexplained message appears.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common recovery mistakes and their fixes
Changing only the password
Why it fails: Existing sessions, refresh tokens, OAuth grants, forwarding, and hidden rules can survive. Fix: Perform the full revocation and persistence review before declaring recovery complete.
Resetting credentials on the suspected computer
Why it fails: Malware or token theft can capture the replacement credentials. Fix: Use a trusted device, scan first, and reimage when responders advise it.
Leaving the attacker’s MFA method in place
Why it fails: The attacker can approve a new sign-in or complete account recovery. Fix: Inventory and remove every unknown method, then enroll verified methods.
Deleting suspicious messages immediately
Why it fails: Deletion destroys evidence and can hide the scope of fraud. Fix: Preserve messages and headers for investigators, then remediate according to retention policy.
Trusting a familiar display name
Why it fails: A compromised mailbox can send genuine-looking mail from a real business account. Fix: Verify payment or account changes through a known phone number or an established second channel.
Declaring victory after one clean sign-in
Why it fails: A clean login says little about forwarding, delegated access, app consent, or data already copied. Fix: Require the complete checklist and documented log review.
When to escalate immediately
- The attacker accessed an administrator, finance, payroll, or executive account.
- Money was transferred, bank details changed, or a payment instruction was followed.
- Personal, health, payment-card, customer, or regulated information may have been accessed.
- You cannot determine when the compromise began or cannot obtain reliable logs.
- The endpoint shows malware, an unknown remote-access tool, or signs of token theft.
- Unknown accounts, roles, applications, or forwarding remain after initial cleanup.
- The organization lacks an independent administrator or a trusted device for recovery.
In these cases, preserve evidence and use professional incident response. Do not repeatedly experiment in the compromised environment; each change can alter logs or give the attacker another opportunity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
