Scope
This guide focuses on email-based threats that endanger financial institutions. You'll find controls linked to PCI DSS 4.0 requirements, advice on authentication architecture, and monitoring strategies to detect compromised accounts before they escalate to Account Data Compromise (ADC) incidents.
This isn't about phishing awareness posters. It's about fortifying your institution's most-targeted attack surface.
Key Concepts and Definitions
Business Email Compromise (BEC): A targeted attack where an adversary takes control of a legitimate email account to steal data, initiate fraudulent transfers, or infiltrate internal systems. For example, Bank of Baroda experienced a breach through a compromised employee account.
Credential Stuffing: Automated attempts to use username/password pairs from third-party breaches. Employees often reuse passwords, and attackers exploit this.
Session Hijacking: Exploiting valid authentication tokens after login, bypassing password controls.
Lateral Movement: After compromising an account, attackers use it to access additional systems, mailboxes, or data repositories.
Requirements Breakdown
PCI DSS 4.0 Controls That Apply to Email Systems
Requirement 8.3.1: Multi-Factor Authentication (MFA) is required for all access to the Cardholder Data Environment (CDE). If your email system can access CDE resources, this requirement applies.
Requirement 8.4.2: MFA is necessary for all remote network access from outside the entity's network. This includes employees checking email from home.
Requirement 8.2.1: Authentication credentials must be unique to each user. Shared service accounts for email lists create gaps in attribution during investigations.
Requirement 10.2.5: Log all access to audit trails by any user. Email systems often store logs with payment investigation data, making them subject to this requirement.
Requirement 12.6.3: Security awareness training should address phishing and social engineering. Your training program must explain why email is a weak authentication boundary.
Beyond PCI: Controls for Email as an Attack Vector
Account monitoring thresholds: Watch for failed login attempts, geographic anomalies, impossible travel patterns, and after-hours access from new devices.
Privileged account separation: Your payment operations team shouldn't use the same email account for vendor communications and CDE access.
Data Loss Prevention (DLP): Use pattern matching for PAN, account numbers, and internal system credentials in outbound email.
Implementation Guidance
Authentication Architecture
Deploy phishing-resistant MFA. SMS codes are vulnerable to interception through SIM swapping. TOTP authenticator apps are better but still susceptible to real-time phishing.
Hardware security keys using FIDO2/WebAuthn provide cryptographic proof of domain identity. An attacker can steal your password, but they can't phish the private key on your hardware token.
Set up conditional access policies that enforce MFA re-authentication when:
- Users access email from a new device or IP range
- Session idle time exceeds 15 minutes
- Users attempt to download more than 100 messages
- Logins occur outside normal working hours for that account's historical pattern
Monitoring and Detection
Develop detection rules for these Indicators of Compromise (IoC):
Inbox rule manipulation: Attackers create rules to auto-forward emails, delete security alerts, or move messages to obscure folders. Alert on any new inbox rule creation, especially those forwarding externally or containing deletion actions.
Mailbox delegation changes: Monitor for new mailbox access grants. An attacker who compromises one account will try to access additional mailboxes without needing those credentials.
Unusual sending patterns: Baseline each user's typical email volume, recipient domains, and attachment patterns. Alert on deviations, especially bulk sends to external addresses or messages with password-protected archives.
OAuth token grants: Third-party application authorizations that request mail.read or mail.send permissions. Attackers use OAuth to maintain access even after password resets.
Segmentation Strategy
Your email infrastructure shouldn't have direct network access to payment processing systems. If an employee needs to review transaction logs, they should use a jump box or privileged access workstation, not email the logs to themselves.
Implement separate email domains or tenants for:
- Payment operations teams (higher security controls, restricted external communication)
- General business operations
- Marketing and external communications
This segmentation limits the impact when a compromise occurs.
Common Pitfalls
Treating email as out-of-scope: Your email system isn't in your CDE, but it's a direct path into it. Attackers don't need to breach your payment gateway if they can compromise the admin managing it.
Legacy protocol exposure: IMAP, POP3, and SMTP AUTH bypass modern authentication controls. Disable these protocols unless you have a documented business justification and compensating controls.
Inadequate log retention: You can't investigate what you didn't log. Maintain email access logs for at least 90 days, longer if your incident response plan requires historical analysis for compromise dating.
Ignoring mobile device access: Your MFA controls mean nothing if users can add their work email to an unmanaged personal device with no PIN requirement.
Alert fatigue from poorly tuned rules: If your security team dismisses 50 false positives daily, they'll miss the real compromise. Tune your detection thresholds using actual user behavior baselines.
Quick Reference Table
| Control Domain | Requirement | Implementation | Detection Signal |
|---|---|---|---|
| Authentication | PCI DSS 8.3.1, 8.4.2 | Phishing-resistant MFA (FIDO2) | Failed auth attempts, new device logins |
| Access Control | PCI DSS 8.2.1 | Unique credentials, no shared accounts | Concurrent sessions from different IPs |
| Monitoring | PCI DSS 10.2.5 | Log all mailbox access, rule changes | New inbox rules, delegation grants |
| Data Protection | DLP policies | Pattern matching for PAN, credentials | Outbound emails with sensitive patterns |
| Segmentation | Network isolation | Email infrastructure separated from CDE | Email server connections to payment systems |
| Session Management | Conditional access | Re-auth on risk indicators | Impossible travel, after-hours access |
| Mobile Access | Device management | Managed devices only, enforce encryption | Unmanaged device enrollment attempts |
| Training | PCI DSS 12.6.3 | Role-specific scenarios, not generic videos | Reported phishing attempts (good signal) |
When you're investigating the next email compromise at your institution, you won't have time to research controls. Bookmark this guide. The difference between a contained incident and a reportable breach often comes down to whether you implemented these controls before you needed them.
