Payment-diversion email fraud stopped
An attacker spoofed a counterparty domain to redirect a payment. Header analysis, DMARC failure and document-metadata forensics confirmed the fraud first.
The situation
An email arrived that appeared to come from a known counterparty, asking for an upcoming payment to go to new bank details. The tone, the signature and the attached document all looked right.
This is business email compromise (BEC): no malware and no suspicious link, just a convincing request to send money somewhere new. It is one of the most expensive types of fraud an organisation can face, because once the payment leaves, it is very hard to recover.
What I did
- Examined the email headers. Compared the real sending infrastructure with the counterparty’s genuine mail. The sending domain was a lookalike of the real one, with a single character changed.
- Checked email authentication. The message failed DMARC, meaning it was not authorised by the domain it claimed to represent.
- Inspected the attachment. Document metadata did not match the counterparty’s genuine documents, which supported the conclusion that it had been created by someone else.
- Raised the alarm before money moved. Shared the findings with the people handling the payment, so it was not sent.
- Built an evidence pack. Collected the headers, authentication results and metadata findings in one document that could be shared with the affected parties.
Outcome
The fraud was confirmed before any payment was made, and a clear evidence pack was shared.
What others can learn
- New bank details by email are a red flag, always. Confirm by phone, on a number you already had, never one from the email.
- Look at the domain letter by letter. Lookalike domains are designed to pass a quick glance.
- Publish and enforce DMARC on your own domains. It makes it much harder for attackers to send email pretending to be you.