A Paso Robles–area contractor called after odd outbound mail started leaving the company domain. Recipients were seeing payment and ACH-style redirects that nobody in the office had written. The mailbox still looked normal from the inside.

That is business email compromise. Weird email and “our mailbox was used to ask for money” need the same disciplined response — not a password change and a hope.

Contain first, then clean

The order matters:

  1. Contain — stop active sessions and limit further sends from the affected account.
  2. Reset — rotate credentials the attacker may already have.
  3. Revoke sessions — kill tokens so an old approval cannot keep working.
  4. Re-check MFA — confirm the methods on the account are still yours.
  5. Hunt inbox rules and forwards — look for silent redirects, deletions, or “move to RSS” tricks that hide the trail.

Skipping straight to “we changed the password” leaves rules and sessions in place. That is how the same mailbox keeps talking to vendors after everyone thinks it is fixed.

What the office usually notices too late

Vendors ask why banking details changed. A partner replies to a thread the owner never started. A bookkeeper finds mail marked read that nobody opened. Sometimes the first clue is a near-miss wire — someone almost moved money because the email looked internal.

You do not need a dollar figure to take it seriously. You need a provider who treats unauthorized mail as an incident, not a help-desk curiosity.

Same playbook for “just weird email”

Not every odd message is a full takeover. Some are probing. Some are spoofed. The response still starts the same way: verify whether the mailbox is sending, whether rules exist, and whether sign-ins look wrong. Guessing from the subject line wastes time.

We run this same contain-and-clean sequence for contractors and professional firms across Central California. Paso desks feel it in payment threads; Valley bookkeepers feel it in vendor invoices. The discipline does not change with the ZIP code.

Finance should already have a rule that payment-detail changes do not move on email alone. IT’s job is to make sure a compromised mailbox cannot quietly rewrite that process with a hidden forward.

What we do

We run a BEC response: contain the mailbox, reset and revoke access, re-verify MFA, and hunt inbox rules and forwards so unauthorized mail stops and stays stopped.

If someone else has started sending as you — or you are not sure — contact us. Contain first; waiting for “more symptoms” is how near-misses become losses.