AegisAI Perspectives · 060
Microsoft Defender for Office 365 and Gmail read senders, links and files, so a payment change request with none of those often passes every native check.
No, not on its own. Microsoft 365 and Gmail check who sent a message and what it carries, and a business email compromise (BEC) request with no link or file, from a real or lookalike sender, gives them little1.
This guide follows one such message through each native check, then shows where AegisAI reads the payment request itself against the sender's history31. BEC drew 24,768 complaints and $3,046,598,558 in reported losses in 202523.
Microsoft 365 inspects the active payload in the message body and every attachment for malware, and checks links against URL blocklists7. Safe Links covers three link formats only: HTTP, HTTPS, FTP14. A request to change bank details carries none of these.
The FBI's Internet Crime Complaint Center (IC3) says BEC is often carried out by compromising legitimate business email accounts, through social engineering or computer intrusion25. Mail from a hijacked real mailbox passes authentication because it is real. A lookalike domain with valid DNS records passes all three authentication checks too.
The vendor variant is common. Singapore police counted at least 66 cases and at least $19 million in losses from requests to change vendors' payment account details between 1 January and 20 May 202628. Scammers used spoofed addresses or the vendors' own compromised accounts.
For the payment controls around the inbox, see how to prevent business email compromise.
Steps 1 to 8 are Microsoft 365. Step 9 is Gmail.
A real mailbox passes, and so does a lookalike domain with valid records. DMARC passes when SPF or DKIM passes with alignment21.
Microsoft 365 adds implicit signals, such as sender reputation and recipient history, to the explicit checks12. A lookalike domain forges nobody's From header, so spoof checks have nothing to match.
Anti-malware inspects the active payload in the body and the attachments.
Safe Links checks links in HTTP, HTTPS or FTP format only. A text only request has no link to check.
Safe Attachments opens attachments in a virtual environment before delivery, and scanning typically completes within 15 minutes15.
The policy compares the sender with a list of protected users, up to 350 per policy, and none are listed by default2. Protected domains work the same way, up to 50 custom domains per policy, none by default26.
It learns who each user writes to. It does not work when sender and recipient have written before, and the setting that lets it act on detections is off by default3.
The tip flags mail from a sender the recipient rarely or never hears from. It is not selected in the default anti-phishing policy; the Standard and Strict presets select it4. Those presets are assigned to no one until an admin assigns them17.
Domain spoofing protection looks for domains visually similar to your own company's domains, and employee name spoofing looks for directory names sent from outside your domain18. A separate setting targets BEC messages that claim your domain without SPF or DKIM27. Each option keeps the message in the inbox with a warning by default20. None of them looks for a lookalike of a supplier's domain.
IC3 advises verifying account change requests through a secondary channel. For the admin settings behind these steps on both platforms, see Microsoft 365 and Google Workspace settings for AI phishing.
| Native control | What it reads | What a payloadless BEC message shows it | Default state and limits |
|---|---|---|---|
| Anti-malware (Microsoft 365) | Active payload in the body, every attachment | No payload, no file | On by default |
| URL blocklists and Safe Links | Links in HTTP, HTTPS, FTP formats only | No link | Built-in protection gives Safe Links to all recipients |
| Safe Attachments | Attachments, opened in a virtual environment | No attachment | Scan completes within 15 minutes in most cases |
| Anti-spoofing and composite authentication | Explicit checks plus implicit signals such as sender history | A pass: the mailbox is real, or a lookalike has valid records | On by default |
| User impersonation protection | Senders close to listed protected users | A match only if the imitated person is listed | None by default; up to 350 users per policy |
| Domain impersonation protection | Sender domains close to listed domains | A match only if the supplier's domain is listed | None by default; up to 50 custom domains per policy |
| Mailbox intelligence | Past mail between sender and recipient | Nothing on a hijacked thread with history | Action on detections off by default |
| First contact safety tip | Mail from a new or rare sender | A tip for a new lookalike; nothing for a known sender | Off in the default policy; on in both presets |
| Gmail domain and employee name spoofing | Lookalikes of your own domains; directory names from outside | A pass for a lookalike of a supplier's domain | Keep in inbox with a warning |
| Gmail unauthenticated email | Mail without SPF or DKIM from any domain19 | A pass when either check succeeds | Question mark next to the sender name |
Illustrative example, figures are fictional. A finance clerk at a 400 person firm gets a reply in a thread with a regular supplier that has run for two years. The supplier's real mailbox has been taken over. The message says the bank has changed and asks that the next invoice, for $48,200, go to a new account. It has no link and no attachment. Authentication passes because the mailbox is real. Anti-malware finds no payload. Safe Links finds no URL. Safe Attachments finds no file. Impersonation protection has no entry for the supplier. Mailbox intelligence sees two years of history and stands down. No first contact tip appears, because this is not a first contact. The message lands in the inbox with no banner. A call to the supplier on a number already on file, the secondary channel IC3 advises, is the only check left.
Judge any added layer on the gap the native checks leave, not on a feature list.
To compare deployment models, use what to check in an API-based email security platform. On Google Workspace, the setup steps are in how to add a third-party email security layer.
AegisAI's agents check every payment request against the sender's history, to stop the BEC that authentication lets through. They read the thread the way an analyst would: the sender's history, the change being asked for, and where the reply actually goes, and each verdict arrives with the evidence32. When a vendor's real account is compromised, authentication passes, so the verdict rests on what this sender has sent you before and on the request itself34. AegisAI connects by API and works after delivery; the median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it33. It starts in monitoring mode with no MX change, and a trial on your own tenant shows results in five days35.
Turn on the native settings first. Assign the Standard or Strict preset, which applies to no one by default. Add every payment approver as a protected user and key supplier domains as protected domains. Turn on the mailbox intelligence action.
If none of these apply, native controls plus a mandatory call back cover the case. If one applies, a layer that reads the request closes a gap the native checks leave open by design. One example is AegisAI's BEC and vendor fraud protection.
Native controls handle BEC that carries a link, a file or a forged From header. They have little to read on a text only request from a hijacked or lookalike sender. If payment changes arrive by email and no call back is mandatory, add a layer that reads the request.
IC3 recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025, up from $2,770,151,146 in 2024.
It stops mail that claims your exact domain without aligned SPF or DKIM. It does not stop a lookalike domain with its own valid records, or a hijacked real mailbox.
No. No sender addresses or domains are protected by default. An admin lists up to 350 users and 50 custom domains in each policy. The Standard and Strict presets apply to no one until an admin assigns them.
Mailbox intelligence does not work when the sender and recipient have written to each other before. A hijacked supplier account sends from a real mailbox with that history. The setting that lets mailbox intelligence act on detections is also off by default.
Not by default. Domain spoofing protection looks for domains visually similar to your own company's domains. Each spoofing option keeps the message in the inbox with a warning by default, and unauthenticated mail gets a question mark next to the sender name.
