The Invoice That Passed Every Gateway
A finance clerk forwards an email to the SOC: subject "RE: INV-4471 Remittance Update", sender display name matches your CFO, but the envelope sender is [email protected] (registered 6 days ago). SPF passes for that domain, DKIM validates, and DMARC shows pass because the sending domain publishes p=none and the message is aligned to its own domain. The body says the bank details for a supplier changed and asks for a same-day £48,000 transfer, quoting a real open purchase order number pulled from a previous thread. The link goes to acme-corp-billing.com/portal which serves a generic login page. The clerk has not clicked. The CFO's real domain is acme-corp.com and publishes p=reject.
1. The clerk argues the email must be genuine because "all the authentication checks passed." Explain why the gateway verdict is not evidence of legitimacy here and what the authentication results actually prove.
Read the worked answer
Authentication answers "did this domain authorize this message?" - not "is this domain the one I trust?" Here SPF, DKIM and DMARC all pass because they are evaluated against acme-corp-billing.com, the domain that actually sent the mail. The newly registered lookalike domain published its own permissive DNS records, so it aligns with itself and DMARC returns pass. The p=none policy means even a failure would only be reported, not blocked.
What the results prove: the message genuinely originated from infrastructure the lookalike domain's owner controls. What they do not prove: any relationship to acme-corp.com, whose p=reject policy is irrelevant because the message never claimed to be from it in the envelope.
So the correct reading is: authentication is intact, identity is fraudulent. The judgement call is to treat a passing DMARC result on an unaligned, newly registered domain as a red flag, not a green light. Escalate for lookalike-domain takedown, verify the bank change by calling the supplier on a known number, and never action payment changes from email alone.
2. List the specific indicators in this message you would extract, and state for each whether it is high- or low-confidence on its own.
Read the worked answer
High-confidence on its own:
- Envelope domain
acme-corp-billing.comdiffers from the true corporate domainacme-corp.com- a clear lookalike. - Domain age of 6 days; legitimate supplier billing domains are rarely days old.
- Request to change bank details with same-day urgency and a £48,000 value - classic business email compromise payment-diversion pattern.
Medium-confidence:
- Quoted real PO number. It is strong social-engineering evidence but could come from a leaked thread or a compromised mailbox, so it points to prior reconnaissance rather than proving this message is fake.
- Generic portal login page - consistent with credential harvesting but not conclusive.
Low-confidence on its own:
- Display-name spoofing of the CFO. Display names are trivially set and common in benign mail; only meaningful combined with the envelope mismatch.
RE:prefix implying an existing thread. Easy to forge.
The judgement point: no single indicator carries the case. The combination of unaligned lookalike domain, young registration and a payment-change request is what justifies blocking and escalating rather than just warning the user.