Phishing & BEC: How to Investigate a Suspicious Email

Phishing is still the number-one way in, and Business Email Compromise (BEC) causes more financial loss than commodity malware - because the "payload" is a wire transfer.

Read the envelope, not the display name

The friendly From name is trivially forged. Judge authenticity from:

• Authentication results - SPF, DKIM and DMARC. Three fails plus a mismatched Return-Path domain is objective proof of spoofing.
• Return-Path / Reply-To - does the reply quietly go to a different domain than it claims?
• Received headers - trace the actual sending path and origin.

Investigate the links & attachments safely

Detonate URLs in a sandbox (urlscan.io, a sandboxed browser) - never click from your own box. Look-alike domains (typosquats) are read right-to-left: login.example-bank.secure-verify[.]cc is owned by secure-verify[.]cc, not your bank.

Scope a BEC

If an account is compromised, the attacker's first move is usually a new inbox rule that hides their replies or auto-forwards mail. Check:

• New forwarding / inbox rules (a top compromise signal).
• New OAuth app grants.
• Sign-ins from unusual locations/devices.

Then revoke sessions, reset the password, and out-of-band confirm any payment change - assume the mailbox is attacker-readable.