You've invested in endpoint detection, network segmentation, and threat intelligence feeds. Your SOC monitors dark web chatter. Yet a single compromised employee email account can still expose customer data, loan documents, and audit files to threat actors selling your information on darknet marketplaces.
The recent incident at Bank of Baroda, where an employee's email account was compromised, illustrates why email security failures remain the most persistent vulnerability in financial services. The bank contained the incident and confirmed its core banking systems weren't accessed, but researchers tracked a threat actor advertising stolen data for sale. This pattern repeats across financial institutions because teams make the same preventable mistakes.
Why These Mistakes Keep Happening
Email security often falls into a gap between infrastructure teams, who manage the mail servers, and security teams, who focus on perimeter defenses. Neither owns the human behavior component. You end up with technical controls that don't address how employees actually use email, training programs that don't reflect current attack techniques, and incident response plans that assume breaches start at the network edge rather than in someone's inbox.
Financial institutions also underestimate the value of email archives to attackers. A compromised account isn't just a foothold for lateral movement. It's a searchable database of customer relationships, internal processes, vendor contracts, and audit findings. The threat actor in the Bank of Baroda case reportedly accessed internal emails, loan documents, and audit files. That's intelligence for future attacks, not just exfiltrated records.
Mistake 1: Treating MFA as Complete Email Protection
Why it happens: You've deployed multi-factor authentication across email accounts and assume that solves the access control problem. Your compliance checklist shows MFA enabled, satisfying auditor questions about ISO/IEC 27001 control 5.17 (authentication information) and NIST Cybersecurity Framework PR.AC-7 (users are authenticated).
The consequence: MFA prevents many unauthorized access attempts, but it doesn't stop an authenticated user from falling for business email compromise, clicking malicious links in seemingly legitimate messages, or having their session token stolen through adversary-in-the-middle attacks. The Bank of Baroda incident involved a compromised employee account. MFA may have been present, but the compromise still occurred.
The fix: Layer email-specific controls on top of MFA. Implement conditional access policies that flag logins from unusual locations or impossible travel patterns. Deploy email authentication protocols (SPF, DKIM, DMARC) to prevent domain spoofing. Use mail flow rules to quarantine emails with suspicious characteristics: external senders mimicking internal display names, urgent requests for credential verification, or links to newly registered domains. These controls operate independently of whether the user successfully authenticates.
Mistake 2: Generic Security Awareness Training for Email Threats
Why it happens: Your annual security awareness program includes a module on phishing. Employees click through slides about suspicious emails, take a quiz, and receive their completion certificate. You've met your training requirement for NYDFS Cybersecurity Regulation §500.14(a), which mandates regular cybersecurity awareness training.
The consequence: Generic training doesn't prepare employees for the specific email threats targeting financial institutions. Attackers researching your organization know your vendors, understand your approval workflows, and craft messages that reference legitimate projects or customer accounts. An employee who can spot a poorly written lottery scam will approve a wire transfer request that appears to come from your CFO's actual email address.
The fix: Build role-specific email security training. Treasury staff need to recognize payment diversion schemes. Relationship managers need to spot account takeover attempts targeting high-value customers. IT administrators need to question urgent requests to reset executive passwords. Run simulated attacks that mirror actual threats your institution faces: vendor email compromise, executive impersonation, or fake regulatory notices. When someone fails a simulation, provide immediate remedial training on that specific technique, not a generic refresher course.
Mistake 3: No Monitoring for Lateral Movement from Email
Why it happens: Your security operations center monitors network traffic, system logs, and endpoint alerts. Email is handled by a separate team using different tools. You detect the compromise only when a threat actor posts stolen data on a forum, or when a customer reports suspicious activity.
The consequence: A compromised email account becomes a staging ground for broader access. The attacker reads messages to understand your environment, identifies high-privilege users, and crafts targeted attacks against other employees. They locate references to file shares, databases, or applications, then use the compromised account's access to pivot. By the time you detect the breach, the attacker has moved beyond email into systems containing customer data, loan portfolios, or audit documentation.
The fix: Integrate email activity into your security monitoring. Alert on unusual mailbox access patterns: bulk downloads of messages, forwarding rules created to external addresses, or searches for terms like "password," "confidential," or "audit." Monitor for OAuth token grants or application permissions added to email accounts. Correlate email events with endpoint and network activity. If an account suddenly accesses file shares it's never touched or queries databases outside its normal pattern, investigate immediately. This monitoring addresses NIST Cybersecurity Framework DE.CM-1 (networks and network services are monitored) by extending detection to email as a potential attack vector.
Mistake 4: Incident Response Plans That Don't Address Email Compromise
Why it happens: Your incident response plan, developed to satisfy ISO/IEC 27001 control 5.26 (response to information security incidents), focuses on malware outbreaks, DDoS attacks, and system intrusions. The playbook for compromised credentials assumes you'll disable the account, reset the password, and move on.
The consequence: When an email account is compromised, you need to determine what the attacker accessed, what they exfiltrated, and who else they targeted. Simply resetting the password doesn't answer these questions. Bank of Baroda contained the incident immediately, but the investigation continues because determining the scope of data exposure requires forensic analysis of mailbox activity, sent items, and accessed attachments. Without a specific playbook, your team wastes critical hours figuring out which logs to pull and which questions to ask.
The fix: Create an email compromise runbook within your incident response plan. Define the immediate containment steps: disable the account, revoke active sessions, remove forwarding rules and delegates. Specify the forensic data to collect: mailbox audit logs, sign-in activity, OAuth grants, and mail flow traces. Identify the threshold questions: Did the attacker access customer data requiring breach notification under applicable regulations? Did they obtain credentials for other systems? Did they use the account to target additional employees? Assign responsibility for each task to specific team members. A Computer Security Incident Response Team that has practiced this runbook will contain the incident faster and provide better evidence for your investigation.
Mistake 5: Treating Email Archives as Low-Risk Data
Why it happens: You classify customer databases, loan systems, and transaction records as high-sensitivity data requiring encryption, access controls, and monitoring. Email archives are treated as business records, subject to retention policies but not the same protective controls.
The consequence: Email archives contain everything attackers need to understand your operations. Internal discussions about control weaknesses, audit findings, customer complaints, vendor contracts, and strategic plans sit in mailboxes accessible to anyone who compromises an account. The threat actor in the Bank of Baroda case reportedly accessed internal emails and audit files. Those documents provide a roadmap for future attacks and leverage for extortion.
The fix: Apply data protection controls to email archives based on their actual content, not their storage location. Implement retention policies that automatically delete emails after business need expires, reducing your exposure window. Use data loss prevention tools to identify and flag emails containing sensitive information: customer account numbers, social security numbers, or internal audit reports. Restrict access to archived mailboxes. Require approval and logging for any bulk export of email data. Encrypt email archives at rest. These controls align with ISO/IEC 27001 control 5.33 (protection of records) by recognizing that emails are records containing sensitive information.
Prevention Checklist
Use this checklist quarterly to assess your email security posture:
Access Controls
- MFA enabled on all email accounts with conditional access policies for unusual access patterns
- Mail flow rules block external senders spoofing internal display names
- SPF, DKIM, and DMARC configured and monitored for your domain
- Regular review of mailbox delegates, forwarding rules, and OAuth application permissions
Monitoring and Detection
- Email activity integrated into SOC monitoring (bulk downloads, rule creation, unusual access)
- Alerts configured for searches containing sensitive terms in mailboxes
- Correlation rules detect email compromise followed by unusual file share or database access
- Regular review of accounts with elevated privileges or access to sensitive data
Training and Awareness
- Role-specific email security training delivered quarterly
- Simulated attacks mirror actual threats targeting your institution
- Immediate remedial training provided after simulation failures
- Executives and high-privilege users receive targeted training on business email compromise
Incident Response
- Email compromise playbook documented with specific containment and forensic steps
- Team members assigned responsibility for each playbook task
- Playbook tested annually through tabletop exercises
- Threshold questions defined for determining notification obligations
Data Protection
- Email retention policies automatically delete messages after business need expires
- Data loss prevention tools identify and flag sensitive information in emails
- Email archives encrypted at rest with access logging
- Bulk export of email data requires approval and creates audit trail
Your email environment is a repository of institutional knowledge, customer relationships, and operational intelligence. Treat it with the same rigor you apply to your core banking systems. The technical controls exist. The frameworks provide guidance. What's missing is the recognition that email compromise isn't just an access control problem. It's a data protection failure with regulatory, reputational, and operational consequences that persist long after you've reset the password.
