Lookalike Domain and a Friday Afternoon Wire
At 4:12 p.m. on a Friday, an accounts payable clerk at a 600-employee logistics firm received an email that appeared to come from the CFO, asking her to urgently update wire instructions for a long-standing supplier ahead of a contract deadline. The thread included what looked like prior correspondence. She called the number in the signature block, reached a person who confirmed the change, and initiated a $486,200 wire. The bank released funds at 5:03 p.m. On Monday the real supplier called about an unpaid invoice. IT found the message came from a lookalike domain registered 11 days earlier, substituting the letters rn for m. The CFO's mailbox had a hidden forwarding rule to an external Gmail address created nine days ago, and mailbox audit logs show a successful login from an unfamiliar Nigerian IP using a legacy protocol. DMARC was set to p=none. The firm carries cyber insurance with a $250,000 retention.
1. Set out the actions for the first 24-48 hours, in priority order, and explain the reasoning behind each.
Read the worked answer
The priority is money first, evidence second, notification third.
Recall the wire. Contact the sending bank immediately and request a recall through the relevant network (Fedwire or CHIPS domestically, SWIFT if correspondent legs exist), and ask the beneficiary bank to freeze the receiving account. Recovery odds fall sharply after 48-72 hours because mule accounts sweep funds quickly, so speed outweighs completeness of the request.
Preserve, do not power off. The clerk's workstation, the CFO's mailbox, and the mail gateway contain the headers and audit records that establish the timeline. Powering down a machine can destroy volatile evidence and trigger encryption; isolate it from the network instead.
Report. File an IC3 complaint, contact the local FBI field office, and notify the firm's bank fraud unit. If any beneficiary is in a high-risk jurisdiction, screen against OFAC before any further transfer activity.
Notify the insurer within the policy's notice window - late notice can jeopardize coverage, and the $250,000 retention means the loss exceeds the deductible regardless.
Preserve communications with the clerk, including her phone records for the call to the number in the signature block, because that call is itself evidence of how the fraud was reinforced.
2. Which forensic artifacts would you collect, and what does the hidden forwarding rule tell you about the attacker's dwell time and method?
Read the worked answer
Collect: full email headers including Received chain, Message-ID, Return-Path, and authentication results (SPF, DKIM, DMARC); WHOIS and passive DNS for the lookalike domain; mail-gateway logs for all messages from that domain; Exchange or Microsoft 365 unified audit logs; mailbox audit entries showing the creation of the forwarding rule; Entra ID or AD sign-in logs, including legacy authentication protocols; MFA registration changes and OAuth consent grants; EDR telemetry from the clerk's workstation; and firewall or VPN logs for the source IP.
The forwarding rule is the pivot. It was created nine days before the request, meaning the attacker had mailbox access for over a week before the fraud was executed. During that window the attacker could read genuine supplier correspondence, learn invoice timing, and mimic the CFO's tone - which explains why the thread looked authentic and why the request landed just before a deadline. The rule also gave the attacker copies of replies, so the clerk's confirmation went straight to the actor.
The Nigerian IP combined with a legacy protocol suggests password spray or credential stuffing against an account that still permitted basic authentication, or theft of a session token. The p=none DMARC policy explains why the spoofed domain was delivered without rejection. Check for additional rules, inbox delegates, and mail-forwarding to other external addresses.
3. Assess the control failures that allowed the loss and the notifications the firm owes.
Read the worked answer
Control failures cluster in three areas. Authentication: DMARC at p=none means the domain owner published a policy but asked receivers to take no action on failures, so spoofed mail was delivered. Access: legacy authentication remained enabled, and there was no alerting on new mailbox rules or unusual sign-in geolocation. Process: vendor bank-detail changes were accepted on the basis of a phone call to a number supplied in the suspicious email, with no callback to a previously verified contact and no dual approval for a $486,200 payment. A single clerk controlled initiation and verification.
Notifications: the insurer under the policy's incident clause; the sending and receiving banks; the FBI via IC3 and direct contact; and the real supplier, who is owed money and may be targeted by the same actor. If the mailbox contained personal data of employees or customers, state breach-notification statutes may apply, and the firm should have counsel assess whether the incident triggers them. Consider whether contractual notification duties to logistics customers apply. Document the FBI engagement and all preservation steps, because the insurer will ask for them and because spoliation claims become a risk once litigation is reasonably anticipated.