A buyer’s mailbox sends new bank details
A supplier asked why the buyer changed bank details. Join sign-ins, mailbox audit, and message trace to order the foreign sign-in, hiding rule, forwarding, and fraud email.
Briefing
Harbor Freight’s accounts team called: an email from your buyer l.moreau asked them to pay invoice PO 55120 into a new account. She says she never sent it.
You have Entra sign-ins, the mailbox audit log, and the message trace, all in UTC. Business email compromise usually follows the same order: sign in, hide replies, forward mail, then send.
ir-ws · Incident timelines
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.