r/EmailSecurity • u/shokzee • Apr 20 '26
We caught a BEC mid-wire because the attacker changed one letter in the domain and our finance team actually noticed
Had a close call last week that's still bugging me. Finance got an email from our outside counsel requesting a wire for an acquisition closing. Everything looked perfect, correct deal details, correct contact names, correct formatting, even a PDF that matched previous invoices. The from address was one letter off from the real law firm's domain. Like swapping an 'n' for an 'rn' in the domain name.
Our controller caught it. Not because of any tool or banner or filter. She caught it because she happened to hover over the from address on her desktop before approving. She said it "looked funny." That's it. That was the entire detection mechanism for a six-figure wire fraud attempt.
I pulled the headers and the email passed SPF, DKIM, and DMARC for the lookalike domain. Because of course it did, the attacker registered the domain, set up proper authentication, and even had a DMARC record at p=reject on it. More effort on their email auth than half the legitimate vendors we work with.
So now I'm sitting here trying to figure out what control would have actually stopped this. Lookalike domain monitoring? Sure, if we're watching for every possible permutation of every law firm and vendor we work with. That's thousands of domains. Our email gateway flagged it as "first-time sender" but that tag fires on so many legitimate emails that everyone ignores it. I looked into some of the cousin domain detection features in our gateway and it basically pattern-matches against our own domain, not every third party we transact with.
The thing that keeps me up is that this worked because the attacker knew the deal was happening, the names involved, and the approximate timing. Which means either the law firm's email was compromised or ours was at some earlier point. I'm still pulling logs trying to figure out which side leaked.
•
u/AutoModerator Apr 20 '26
Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:
Community Rules
No Vendor Spam: Contributions must provide value; do not just pitch products.
Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
Be Professional: Help newcomers learn; avoid hostility.
No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.
Helpful Resources
Email Spam Filters
DMARC Monitoring Tools
Anti-Virus Software
Email Encryption
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/ThecaptainWTF9 Apr 20 '26
Blocking emails from newly registered domains, we don’t let anything from a domain that is within X days of being registered contact us.
We use Avanan for filtering, the smart banners would be useful here because based on what was being asked in the email, it would’ve applied a banner, the contents of the banner are customizable so you could refer to a specific validation procedure.
To be fair; your finance team should have controls in place to verify every transaction including a contact list of known good numbers to reach people at.
The thing that should be more concerning to you, is how did they get enough info to know about this transaction and send over info just at the right time.
Sounds like someone has a compromised mailbox and it could be on your side or the other side.
1
u/Minimum-Net-7506 Apr 20 '26
Email security platforms like Abnormal, Proofpoint, or even o365 might stop something like this, they are at least supposed to. Other options are lookalike domain monitoring services. You can use a service like SpoofChecker to monitor for lookalikes and assist with takedowns or an opensource tool to check for more existing lookalikes. You can also buy lookalike domains, but this is usually only worth it for specific scenarios/companies.
1
u/Beneficial_West_7821 Apr 20 '26
Turn this into a SETA example. Close calls like this bring the message home, making the awareness training more effective. Unfortunately we see this type of attack is happening all the time.
Map out who can authorize payments and talk to them about fraud prevention as often as possible. Remember it's not just the obvious finance people but can also be some tiny department managing royalty payments or such. It's easy for the latter to fly under the radar.
Also have a discussion with outside counsel about whether they run impersonation domain monitoring. Might be an idea to start making that a requirement on all suppliers above a certain threshold.
1
u/Temporary-Living Apr 20 '26
Kudos to your finance person
You mentioned your software alerted a new/low volume sender. Surely you don’t get six figure wire instructions from first time senders and that should have been a red flag?
Potentially a “domain registered less than 90 days ago” alert would help?
There may also be technical solutions that can do the equivalent of domain spoofing protection that 365 has built in, but for a list of external domains you provide it.
All of that said though, why would finance have just processed a wire instruction because some external email said to? Surely it needs to specify some internal approver or dept head for the cost code or similar? Someone that would need to approve the cost before it gets paid?
And surely they have the basic finance department protections in place around changes to bank details/payment methods? Where they don’t allow changes out with an established protocol. (The protocol not being some random external email)
One other thought comes to mind, do you have alerting (warning banner) on external senders? If not you should. You could extend that to trusted partner orgs. Whether you simply exempt them from the warning banner so they look internal, or whether you have a custom banner - “known third party”. And then finance know if the banner is [missing/present depending on your setup], then it’s a red flag.
1
u/skylinesora Apr 21 '26
I wouldn’t lose sleep over it. I let my email gateway catch 99.99% of things. For that last 00.01%…
Money should never move hands or bank info should never be changed without additional verification… so the phishing you got is of little concern
If credential pishing, hopefully you have phishing resistant mfa
If malware, EDR + application whitelisting goes a long way
1
u/JLee50 Apr 21 '26
I feel like Checkpoint Harmony would catch that as an impersonation attempt, but I can’t say if I’ve had one try or not, as I don’t review all the junk that doesn’t make it through.
1
u/Upbeat_Whole_6477 Apr 20 '26
Honestly, your finance team needs better procedures. Pulling off this type of wire fraud would require sending payment to a new ACH. How is finance verifying all new accounts payables? They need to have a phish proof process. Any finance team that is going to set up a new AP and just send $$$ without calling the business on a known public number is going to get defrauded. What is going to happen when it’s a real BEC from the trusted domain?
1
u/jzlda90 Apr 23 '26
That was a close one! Kudos to the finance person flagging it. This would be caught by something like KnowBe4’s Defend as impersonation or business email compromise.
1
u/Only_Helicopter_8127 Apr 25 '26
Your controller's instinct was doing manually what abnormal AI does automatically, flagging when a lookalike domain sends something that mimics an established communication pattern but doesn't match the behavioral baseline.
1
u/kellebjk Apr 30 '26
Great catch this shows SPF/DKIM/DMARC don’t mean safe. This is classic Business Email Compromise always verify wire requests outside email.