Fabrikam: lookalike-domain BEC that authenticates perfectly and carries no payload

Why nothing fired.

• Authentication was never the control here. The attacker sent from fabrikam-corp.co, which passes SPF, DKIM and DMARC for itself. DMARC protects the domain in the From field; it says nothing about whether that domain resembles yours. The alignment checks all pass legitimately.
• URL Defense had nothing to rewrite into a verdict. The link resolved to a clean file-sharing page at delivery and at click time. Click-time defences detect malicious destinations; a benign destination carrying a social-engineering pretext is invisible to them.
• Attachment sandboxing had no attachment to detonate.
• Volume-based scoring worked against detection. Two to four messages to six users over three days sits inside normal conversational traffic; there is no campaign-sized burst to cluster on.
• Human-targeted content. 30–45 word plain-text bodies aimed at one department are precisely the shape of legitimate executive mail, which is why the classifier's content features were neutral.

Signals that were present and usable:

1. Display-name and domain similarity to a known internal executive identity (impostor/BEC classification family).
2. Domain age - nine days old at first send; a strong, cheap feature.
3. First-time sender for every recipient and for the organisation.
4. Recipient concentration - finance only, six users, shared mailbox distribution list.
5. Reply-to / From consistency and the fact that replies would leave the organisation to a newly registered domain.
6. Intent language - payment confirmation, wire, urgency, no prior thread.
7. External origin on an executive-impersonation pretext - the mismatch between 'CFO' and an external domain is itself the signal.

Priority 1 - impostor/BEC detection tied to your VIP list. Populate the executive and finance-approver display names and addresses, and enable classification of external mail that impersonates them. This directly targets the observed attack and costs nothing in delivery for unrelated senders.

Priority 2 - lookalike-domain protection based on registration monitoring, not on guessing. Subscribe to newly registered domains that are edit-distance or homoglyph variants of your domain and key suppliers, and feed them into blocking. Detection at registration gives you days of lead time before first use.

Priority 3 - external-sender marking. A consistent banner on all inbound external mail, plus a clear 'this is not an internal address' display treatment. This is the cheapest control that survives classifier failure, because it moves the judgement to the recipient at the moment of reading.

Priority 4 - process controls that no email filter can substitute for. Callback verification to a known number for any bank-detail change, dual approval on wire instructions, and a supplier master list. The attack asked for a wire confirmation; the process is the last line.

Priority 5 - reporting loop. One-click user reporting with feedback to reporters, so the next variant is caught in minutes rather than at the third day.

Measurement before enforcement. Run new impostor and lookalike rules in monitor/tag mode for two to three weeks and track: (a) daily matches, split by confirmed-malicious vs legitimate; (b) which legitimate senders trigger - expect recruiters, newly onboarded vendors, and marketing agencies; (c) quarantine release rate and time-to-release; (d) user-reported messages per week. Enforce only on the rule subsets with a clean false-positive record, and keep an exception process with a named owner. A rule that blocks correctly but generates 50 releases a week will be disabled by the service desk within a month.

The request is directionally right and technically unbounded. Variants of fabrikam.com are effectively infinite once you include character substitutions, added words (fabrikam-corp, fabrikam-group), alternate TLDs, and homoglyphs. Any static blocklist is a snapshot that an attacker can step around with one new registration, and the more aggressive you make similarity matching, the more legitimate mail you lose - new vendors, recruiters, and regional domains that genuinely resemble yours.

What I would commit to instead, as three layered commitments:

1. Registration monitoring with automated ingest. Continuous feeds for new domains similar to our primary domain and to a maintained list of critical suppliers and customers; auto-block on detection, with an alert to the SOC so a human confirms and hunts for delivery.
2. Similarity-based classification at delivery, enforced conservatively. Impostor and lookalike scores contribute to disposition; the rule requires combination - similarity plus (new domain OR first-time sender OR VIP display name OR authentication gap). Single-signal similarity never blocks on its own, because similarity alone is what generates the false positives.
3. Non-email controls that hold when the filter fails. External-sender banner, callback verification for payment changes, dual authorisation on wires, and a rehearsed user-reporting workflow.

On expectations management. Tell the executives plainly: no filter stops 100% of lookalike domains, because the attacker's cost of a new registration is a few dollars and ours of a wrong block is a lost invoice or a missed customer. The honest target is 'detect within hours of registration, block on delivery, and have a human process that holds if both fail' - and then report on each of those three separately rather than claiming a block rate that cannot be measured.