Finance: business email compromise

Re: April remittance · thread of 6

From: Maria Chen

Subject: Updated remittance details, before your next run

Hi, great working with you this quarter. Quick heads-up before the next payment run.

Please route all future payments to our new account: ****4471. most expensive line in your inbox

Thanks again, and let me know if you need an updated W-9.

no link · no malware · passes every filter

Held until verified

Payment

Outbound call

Vendor: number on the vendor master

NOT a number from the email

Second person signs off

Role spotlight · Finance & approvers

“We’ve updated our banking details”

No banking change is processed from the email. You call the number you already had on file, and a second person signs off.

Scenes

Part 1 · Introduction

Part 2 · Anatomy of an Attack

Part 3 · Red Flags

Part 4 · What To Do

Part 5 · Business Email Compromise

Part 6 · Recap