Email Account Compromise (EAC)

Email account compromise (EAC) is an attack in which criminals gain control of a legitimate email account and operate from inside it. It is closely related to business email compromise, and the FBI tracks the two together, but the mechanism differs in a way that matters for defense: classic BEC impersonates a trusted sender with a spoofed or look-alike address, while EAC is the trusted sender. Every message passes SPF, DKIM, and DMARC, comes from the genuine address, and sits inside real conversation threads — because it is sent from the real mailbox.

How it works

The takeover starts with credentials: a credential harvesting phishing page, an infostealer on a personal device, password reuse from an old breach, or an adversary-in-the-middle kit that captures the session token along with the password. Once in, the attacker rarely announces themselves. They read. Weeks of silent mailbox access reveal who pays whom, what invoices look like, and which deals are in flight. Inbox rules are planted to auto-delete or re-route replies so the owner never sees the fraud unfolding. Then the attacker strikes at the highest-value moment — typically hijacking an existing thread about a real payment to send "updated banking details," or launching convincing phishing at the victim's own contacts, who have every reason to trust the sender.

How to defend against it

Technical email authentication cannot help here — the mail is authentic — so defense concentrates on preventing the takeover and breaking the money flow. Enforce phishing-resistant MFA on email accounts, alert on suspicious inbox rules and impossible-travel logins, and audit OAuth grants that give third-party apps mailbox access. Procedurally, require out-of-band verification on a number already on file for any banking change, no matter how legitimate the email looks; that single rule defeats the attack's endgame. And because the entry point is almost always a harvested credential, train and test employees against the lures that steal them — realistic simulations show who would hand over a password before an attacker asks.