AegisAI Perspectives · 014
Turn on Gmail spoofing settings, enforce security keys, switch off forwarding, then hunt and remove. Admin console steps for BEC in Google Workspace.
Turn on the Gmail Safety spoofing settings, enforce security keys, switch off automatic forwarding and audit delegates. IC3 logged 24,768 BEC complaints in 20251. Together these controls stop spoofed senders and limit what a hijacked account can do.
BEC reaches Google Workspace two ways. A spoofed sender claims your domain or a colleague's name. Or an attacker holds a real account and writes from it. IC3 defines BEC as compromising email accounts and other communication channels to conduct unauthorized transfers of funds3, and it listed 2025 losses of $3,046,598,5582. Steps 1 to 6 are settings you change once. Steps 7 and 8 are what you run when a takeover is suspected.
In the Admin console go to Apps, Google Workspace, Gmail, Safety. Switch on "Protect against inbound emails spoofing your domain", which targets messages that fail both SPF and DKIM and claim your domain, and "Protect against spoofing of employee names"4. The default action keeps the email in the inbox and shows a warning5. Choose move to spam or quarantine instead. Verify: warning banners show only in Gmail web7, so users on other clients see no warning until you change the action.
Remove internal senders from spam bypass and remove your own domains from the approved senders list10. Verify: allowlist settings do not override quarantine6, so a quarantine action holds for the senders you still allow.
Google's checklist says to enforce security keys at least for admins and other high-value accounts8. The Advanced Protection Program goes further: it requires security keys or passkeys and blocks apps that request high-risk OAuth scopes unless an admin trusts them24. Google states that 2-Step Verification can cut account takeover by as much as 50%25. Verify: the checklist tells you to review activity reports for 2-Step Verification enrollment11.
Go to Apps, Google Workspace, Gmail, End User Access, Automatic forwarding. It is on by default, and you can limit it to internal addresses12. The checklist calls forwarding to outside addresses a common exfiltration method9. Verify: with the setting off, the forwarding option no longer appears in users' Gmail settings.
Open Gmail, then User settings, then Mail delegation. A delegate can read the mailbox and send and receive messages for the user14. Apply the setting to the organizational units that need it. Verify: changes can take up to 24 hours to apply15.
The checklist lists alerts for suspicious sign-ins and admin setting changes. A suspicious login alert fires for a sign-in outside the user's normal pattern, such as an unusual location23. Verify: alerts stay in the alert center for approximately 10 years22.
Suspend the user. Suspending blocks access and resets sign-in cookies and OAuth tokens16. Read user log events for sign-ins17, run Email log search for message flow, and use the Gmail API to check for forwarding18. After the password reset, revoke the OAuth 2.0 tokens and remove app passwords19. Verify: no forwarding address, filter or token remains that you did not create.
In the security investigation tool, search for the message, then delete it, mark it as phishing, or send it to quarantine20. Verify: quarantined messages are deleted when Vault retention triggers, 30 days by default21.
| Control | Default | What it covers | Source |
|---|---|---|---|
| Inbound domain spoofing | Keep in inbox, show warning | Mail that fails SPF and DKIM and claims your domain | |
| Employee name spoofing | Keep in inbox, show warning | A directory name used from a non-company domain | |
| Automatic forwarding | On | Silent copies to outside addresses | |
| Mail delegation | Not stated by Google | Another user reading and sending as the mailbox owner | |
| Security keys | Your policy | Sign-in by an attacker holding a stolen password | |
| Admin email alerts | Set by you | Sign-ins outside the user's normal pattern |
Two gaps matter for BEC. The forwarding page says users can create Gmail filters that forward only certain messages, and each user can set up one forwarding address13. It does not say whether the admin setting also blocks filter-based forwarding. The compromised-account page does not mention delegation.
Test both in your own tenant. Create a filter with a forward on a test user after you switch forwarding off, and see what happens. Then add a delegate on a test mailbox and find where it shows in the logs. One mailbox supports up to 1,000 unique delegates, so list delegates for finance and executive accounts by hand.
Illustrative example, figures are fictional. A 300 person firm has a finance manager whose password was phished. At 08:52 user log events show a sign-in from a new country. At 08:55 a filter starts forwarding any message with "invoice" to an outside address. At 09:10 the attacker replies to a supplier thread with new bank details, from the real account.
The suspicious login alert reaches the admin at 09:15. At 09:20 the admin suspends the user, which resets sign-in cookies and OAuth tokens. A search in the investigation tool for the thread subject returns 14 copies in 9 mailboxes. The admin marks all 14 as phishing and deletes them. The filter and the forward are removed. A call to the supplier on the number already on file decides the payment.
The sequence shows why the first six steps matter. Forwarding switched off, with a test that filters cannot forward either, would have blocked the copy to the outside address. A security key requirement would have stopped a sign-in that used only the phished password. For the wider attack picture, see how BEC and account takeover attacks are built.
Track three numbers.
For the layered checklist around payments and vendors, see how to prevent business email compromise.
No. It does not cover a hijacked account. The inbound spoofing setting targets mail that fails both SPF and DKIM. A message from a compromised account passes both checks. Security keys and alert rules carry that case, plus the forwarding setting.
The settings above cover spoofed senders and account takeover. They do not read the request inside a message from a real account. For a layer that does, see how to add a third-party email security layer to Google Workspace and what cloud email security covers.
Turn it off by default and allow internal addresses only where a team needs it. Google's checklist calls outside forwarding a common exfiltration method. Check filters separately, because the forwarding page does not say the setting covers them.
Yes. The security investigation tool lets an admin delete messages, mark them as spam or phishing, or send them to quarantine. Starting an investigation from an alert needs an Enterprise edition. If a bulk action times out, narrow the date range.
User log events keep sign-ins for up to 6 months. Quarantined messages go when Vault retention triggers, 30 days by default. Alerts stay for approximately 10 years. Work from the shortest window first.
