Account takeover detection for business email

Account takeover (ATO) detection for email means watching supported Microsoft 365 and Google Workspace audit records for signals that someone else may control a mailbox — unexpected sign-ins, new forwarding, inbox-rule changes, and similar events — then alerting you in plain English.

InboxGuards is an alarm on those records, not a staffed SOC and not a guarantee that every takeover is visible before fraud. Provider APIs, licenses, retention, and timing still limit what shows up.

Account takeover is when an attacker uses valid credentials (or a token/session) to operate a real mailbox. Business email compromise (BEC) is the fraud that often follows: changed bank details, fake invoice threads, or executive payment requests sent from that access — or from a convincing lookalike.

Detection work starts with the takeover signals in audit data. Stopping every BEC payment still depends on how your team verifies money moves.

• ■ATO signal examples: unusual sign-in location, MFA change, unexpected app grant, mailbox permission change.
• ■BEC follow-through: payment redirection, vendor impersonation, reply-hiding rules or forwarding.
• ■Monitoring helps you notice supported signals sooner; it does not replace payment verification.

After a customer admin grants read-only access, InboxGuards checks supported audit records at the fastest cadence available on standard Microsoft 365 and Google Workspace plans — no premium security licensing required — and emails an alert when a configured rule matches.

• ■Read-only connection — no mailbox message content, no tenant setting changes from InboxGuards.
• ■Plain-English alerts with enough context to decide the next step yourself.
• ■$2 per active user per month, no minimum seat count, 30-day money-back guarantee.

Some takeover techniques leave little or no trail in the audit records InboxGuards can read. Google Gmail filter changes are one known blind spot. Delays in provider ingestion mean an alert can arrive after an event, not before.

Use monitoring next to MFA, admin hygiene, and a habit of verifying payment changes out-of-band — not instead of them.

Practice spotting scam mail with the free email scam simulator (no login). Read the BEC explainer if you want the fraud pattern in plain terms.

• ■Free email scam / phishing simulator — fictional scenarios, no account connection.
• ■What is business email compromise?
• ■Microsoft 365 email security and Google Workspace email security.
• ■Free SPF / DKIM / DMARC spoofing check.