Incident Response
Follow the message. Examine the account.
Investigate suspicious email activity, account compromise and communications associated with payment fraud.
01
Clarify the reported event.
Identify the accounts, messages, relevant transaction or request, and the time it was discovered. Preserve the distinction between a suspicious message and a confirmed compromised account.
02
Examine relevant records.
Review available mailbox, sign-in and audit evidence under authorized access. Retention and configuration may affect what is available; do not assume every historical event is recorded.
03
Support a coordinated response.
Share understandable findings with the response team. Technical account actions, financial steps and legal decisions involve different responsible people and should be coordinated rather than left implicit.
RELEVANT SOURCES
Start with what is available.
Discuss the sources that can help answer the question, within an authorized scope.
Mailboxes and message headersBEFORE WE BEGIN
A more useful first conversation.
- Identify affected accounts and messages.
- Record what was discovered and when.
- Coordinate access with an authorized administrator.
RELATED ARTICLES
Useful before you need us.
Practical perspectives and clear next steps.
YOUR NEXT STEP
Bring clarity to the response.
Tell us what you need to understand.