Business email compromise (BEC) playbook 

This playbook has technical guidance for responding to a business email compromise incident. It is not a standalone resource: use it alongside your incident management plan to make sure it works for your school.

---

Recovery

Depending on the types of accounts your school uses, there are multiple ways to recover a potentially compromised account. Contact your service provider or IT support team to assist in recovery.

Your email account provider will have specific actions to take.

For example:

• If Microsoft has locked the account for suspicious behaviour, ask your service provider to unlock and secure the account or contact Microsoft directly
• If a Google account has been locked, contact your service provider or Google

---

Page last reviewed
13 May 2026