The Business Email Compromise Guide sets out to describe 10 steps for performing a Business Email Compromise (BEC) investigation in an Office 365 environment. Each step is intended to guide the process of identifying, collecting and analysing activity associated with BEC intrusions. If you require additional support with BEC detection or response, please reach out either directly or via nl_incidentresponse[@]pwc[.]com