These Scams Are Not Hypothetical.
They Happened. To Real People.

Jaguar Land Rover was hit by a major cyberattack in 2025. Security researchers investigating the attack identified targeted phishing emails, stolen employee passwords, and manipulation of staff among the methods tied to the attackers. JLR never disclosed the precise point of entry.

JLR shut down its global systems and paused production for five weeks. The disruption spread through its dealers, suppliers, and the wider automotive supply chain. JLR reported £196 million in cyber-related costs, while the UK's Cyber Monitoring Centre estimated the wider economic impact at £1.9 billion across more than 5,000 organizations, calling it the most financially damaging cyber event ever to hit the UK.

Evaldas Rimasauskas registered a real company in Latvia and gave it the same name as Quanta Computer — a legitimate Taiwan-based hardware manufacturer that did real business with Facebook and Google. Not a near-miss spelling. The actual name. Over two years, he sent fraudulent invoices with spoofed email addresses, along with forged contracts and fake corporate seals. Employees at both tech giants wired payments to bank accounts he controlled in Latvia, Cyprus, Hungary, and Hong Kong.

Facebook wired nearly $100 million. Google wired over $23 million. Rimasauskas was extradited from Lithuania, pleaded guilty to wire fraud, and was sentenced to five years in federal prison. He was ordered to forfeit $49.7 million and pay $26.5 million in restitution.

Orion S.A. is a chemical manufacturer listed on the New York Stock Exchange. On August 10, 2024 the company determined that one of its employees — specifically not a senior executive — had been the target of a criminal scheme that resulted in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties. Nobody broke into Orion's systems. Someone convinced a person to send the money.

Orion told the SEC two days later that it expected a one-time pre-tax charge of roughly $60 million for the transfers it had not recovered. The same filing states the company found no evidence of any other fraudulent activity and does not believe the incident involved unauthorized access to its data or systems. Law enforcement was notified and Orion said it would pursue recovery, including through insurance.

FACC — an Austrian aerospace manufacturer that makes parts for Boeing, Airbus, and Rolls-Royce — received a fraudulent email impersonating its CEO, Walter Stephan. The email instructed an employee in the finance department to wire roughly €50 million to fund a "confidential acquisition." The employee complied. By the time FACC realized what had happened, the money had moved through banks in Slovakia and Asia.

FACC recovered about €10.9 million but took a €41.9 million loss. The company posted a pretax loss of €23.4 million for the fiscal year. The supervisory board fired CEO Walter Stephan and CFO Minfen Gu for "severely violating their duties" in what FACC dubbed the "Fake President Incident." The finance employee who executed the transfer was also dismissed.

A Singapore commodity firm received an email that appeared to come from one of its legitimate suppliers. The sender's email address differed from the real supplier's address by just one character — an “i” had been replaced with an “l.” The email instructed the company to send a pending payment to a new bank account in Timor-Leste. The company transferred $42.3 million.

The scam email arrived on July 15 and the transfer went out on July 19. Four days after that, the genuine supplier told the company it had never received the payment. Singapore Police filed a report and contacted INTERPOL, whose rapid payment-interception mechanism reached authorities in Timor-Leste within 24 hours. More than $39 million was withheld from the fraudulent account, roughly another $2 million was recovered in follow-up work, and seven suspects were arrested in Timor-Leste — over $40 million returned in total.

On August 14, 2019, the European subsidiary of Toyota Boshoku Corporation — a Toyota Group parts maker that supplies car seats and interiors — acted on fraudulent payment directions sent by a third party and transferred company funds outside the company. Toyota Boshoku disclosed the incident on September 6, putting the expected loss at up to roughly ¥4 billion, about US$37 million.

The company said it became aware the directions were fraudulent shortly afterward, assembled a team of legal professionals, and reported the loss to local investigating authorities. Toyota Boshoku did not publish the contents of the email or the sender details.

Between March 8 and March 27, 2018, the Dutch arm of the French cinema group Pathé received a series of emails purporting to come from the CEO of Pathé in France. They described a confidential acquisition of a cinema operator in the Gulf, said the matter "must remain strictly confidential," and asked that replies go only to a personal address. Four transfers totalling €19,244,304 went to an account in the name of Towering Stars General Trading in Dubai.

Pathé Nederland's managing director Dertje Meijer and financial director Edwin Slutter were suspended and dismissed. The details became public through an October 31, 2018 ruling of the District Court of Amsterdam in Slutter's unfair-dismissal claim, which found in his favor on the severance he was owed.

Attackers emailed the India head of Tecnimont SpA, part of the Italian group Maire Tecnimont, from an account that looked deceptively similar to one used by the group's CEO. They then staged a series of conference calls in which members of the group played the CEO, other senior Tecnimont executives, and a Swiss lawyer, to discuss a "confidential" acquisition in China. The India head was told the money could not be sent from Italy for regulatory reasons. He authorized three transfers in one week — $5.6 million, $9.4 million and $3.6 million — to banks in Hong Kong, where the funds were withdrawn within minutes.

The fraud surfaced when Tecnimont SpA's chairman visited India. The company dismissed its India chief and its head of accounts and finance.

MacEwan University received a series of emails from what appeared to be Clark Builders, a construction firm the university had worked with for more than a decade. The messages carried the vendor's logo and asked staff to update the banking details on file. Staff made the change. Between August 10 and August 19, 2017, three payments — ranging from about $22,000 to $9.9 million — went to accounts the fraudsters controlled. The scheme relied on fake websites and targeted emails impersonating more than a dozen Edmonton-area construction companies.

The fraud came to light on August 23, when the real contractor called to ask why it had not been paid. Working with banks, lawyers in several jurisdictions and police, the university traced and froze funds in Canada and Hong Kong. By the time proceedings concluded in April 2018 it had recovered about $10.9 million — roughly 92% of what was taken. The remaining shortfall was covered from reserves.

A Malaysian company had been buying liquefied petroleum gas from an overseas supplier since January 2023. On June 22 it received an email from someone presenting as a representative of that supplier, instructing that payment be made to a new bank account. The company paid. It only learned it had been defrauded when the real supplier said the money had never arrived.

Bukit Aman's Commercial Crime Investigation Department, working with Bank Negara Malaysia and the banks involved, traced the transfers and stopped RM28,361,636 from reaching a foreign account. Its director, Datuk Seri Ramli Mohamed Yoosuf, described the method plainly: syndicates hack or monitor a company's email to watch its transactions, then pose as a business partner or supplier. His advice was equally plain — be wary of any instruction to change a bank account for payment, and phone the supplier to confirm.

In September 2020, offenders claiming to be staff sent internal invoice emails to an Australian company's finance area — the same routine paperwork that team processes every day, but with the bank details altered. Finance paid twice: AUD 519,545, then AUD 2,148,938. Both payments went to an account in Singapore.

The Australian Federal Police coordinated with INTERPOL and the Singapore Police Force. The first transfer had already been drained by the offenders, but the second was intercepted after the bank was alerted — AUD 2.1 million of the AUD 2.67 million was recovered. The AFP published the case as part of a disclosure that business email compromise had cost Australian victims more than $79 million in twelve months.

Criminals intercepted the emails going back and forth between a homebuyer and their solicitor. They then set up an email account made to look like the solicitor's and sent payment instructions on headed paper — for exactly the amount the buyer was already expecting to pay. The buyer sent £640,000. The solicitor later confirmed they had never asked for it.

Most of the money was never recovered and the purchase collapsed. The Law Society published the case alongside the National Economic Crime Centre and Action Fraud, with one clear piece of advice for buyers: always call your lawyer to check before transferring money, because emails can be intercepted or diverted.

Judith Hawarden was buying a home in Forest Town, Johannesburg, and had to pay the balance into the trust account of the law firm Edward Nathan Sonnenbergs (ENSafrica). The firm's banking details were sent to her as a PDF attached to an email from a secretary in its property department. The correspondence was intercepted and the account details in it were substituted for the fraudster's. The email in the chain did not come from the firm at all.

Real

ensafrica.com

Fake

ensafirca.com

On August 22, 2019, Hawarden transferred R5.5 million. It went to the fraudsters and was gone.

Hawarden sued the law firm. In January 2023 the Johannesburg High Court ordered ENSafrica to pay her R5.5 million, plus interest and extra costs as a penalty. ENSafrica appealed, and on June 10, 2024 the Supreme Court of Appeal overturned that ruling, deciding the firm had no legal duty to warn her about the risk. Hawarden did not recover her money. The appeal changed who bore the loss; it did not change how the fraud was carried out.

A scammer emailed the "Shark Tank" investor's bookkeeper posing as Corcoran's assistant, using an address that misspelled the real one by a single letter. The message carried an invoice for a real estate renovation — $388,700.11, from a company called FFH Concept GmbH in Germany. Nothing about that is odd for someone who invests in property, which is exactly why nobody questioned it. The bookkeeper wired $388,700 to an account in Germany. Nobody questioned it until the bookkeeper noticed the address was wrong.

Corcoran initially said the money was gone. Her bank then asked the German bank to freeze the transaction while her team proved the payment was fraudulent, and the funds were returned to her in early March 2020 — an outcome that is the exception rather than the rule.

Chile's central bank owed $205,000 to RVK, an American consulting firm that advises on sovereign fund management. Someone set up an email account in the name of the firm's real contact, changing the address only at the very end.

Real

name@rvkinc.com

Fake

name@rvkinc.co

Writing as the consultant, they asked for the payment to go somewhere else instead — to a company called JDB Investment Limited LLC, at a Wells Fargo account in New York. The bank made two transfers, $16,400 and $188,600.

The real consulting firm eventually asked why its invoice from March had not been paid, and confirmed the email account was fake and the money had never reached it. The Banco Central de Chile filed a criminal complaint with Chile's Ministerio Público and opened an internal investigation, which found no evidence of employee involvement and no other funds affected.

Brian Oliver received an email claiming PayPal owed him $450. He called the phone number in the email. The scammer walked him through a fake "typo" that appeared to deposit $10,000 into his Bank of America account — except the bank website he was looking at was a mirrored fake. Over the next three days, Oliver fed $10,000 in cash into a crypto ATM and handed $198,560 in gold coins to a courier driving a black Mustang. The password at the door was "blue."

Gainesville Police set up a sting operation. One courier, Seth Wayne, received 18 years in federal prison. A second courier, Atharva Shailesh Sathawane, was convicted of conspiracy and money laundering tied to over 30 transactions and nearly $8 million stolen from elderly victims.

A Tasmanian homeowner renovating her property was corresponding with a construction company when scammers intercepted the email thread. They wrote to her from a spoofed address that closely mimicked the legitimate business, telling her the company had updated its banking details. The invoice they attached was an exact replica of the real one — every line the same, except the payment details, which now pointed to the scammers' account. She paid AUD 120,000.

Because the fraud was reported late, the money was not recovered. The Australian Federal Police published the case in a warning about criminals targeting the construction sector, where large scheduled payments between homeowners, builders and suppliers make an altered invoice unremarkable.

A fraudster compromised the mailbox of Cheers Exhibition Services, a Dubai exhibition-stand company, and read its correspondence to learn which contracts were live. He then registered a second web address, one letter off from the real one, and wrote to the firm's clients from it — copying the real signatures, logos and invoice formatting.

Real

md@cheersexhibitions.com

Fake

md@cheersexhlbitions.com

A Russian client, paying for a stand at GITEX in Dubai, wired $53,000 (Dh194,700) to an account at a bank in Finland.

The account had been opened in the company's own name by the fraudster. Gulf News reported that police described the operation as far more sophisticated than ordinary phishing — the difference between the two addresses, as investigators put it, was not apparent to the naked eye.

Jenna Carlson had saved for years to buy her first home. She was putting 20% down — $42,000. She had exchanged 16 emails with her real estate attorney's paralegal, asking clarifying questions before the wire. One of those emails contained the wiring instructions. She went to the bank and sent the money. The next day, the real paralegal called asking about the down payment. Carlson said she'd already wired it. The paralegal replied: "What email? I didn't send any email." The sender's address was nearly identical to the paralegal's — just two extra letters added.

Chase Bank was able to stop $9,000 of the wire. The other $33,000 was gone. "It was fraud and I'd been scammed," Carlson said. "Everything I'd saved was gone in the blink of an eye. And I couldn't do anything about it." She went through months of therapy to cope with the loss. FBI Special Agent Siobhan Johnson, quoted in the ABC7 story, said real estate wire fraud is one of the fastest-growing cyber scams in the country.

A Dubai company received an email from a client it already did business with, asking for dues to be paid. It was not the client. As the prosecutor put it, the suspect had misled the company by creating a similar email format with one letter changed. The company wired Dh100,000. The first suspect received the money and immediately moved it to the second suspect's account.

Dubai prosecutors charged both men with fraud and illegally obtaining Dh100,000, and sent the case to the Misdemeanour Court even though neither man was there to answer it.

A Christchurch solar-panel manufacturer was approached by email for a quote on goods, then received a purchase order from what appeared to be a New Zealand university. The address was not the university's. Fraudsters running the scheme used altered addresses impersonating New Zealand universities and a district health board, changed only by minor punctuation — enough to own the address, little enough to read as legitimate. The goods were shipped, the scammers paid the freight, and the invoice went to the institution that had never ordered anything. The manufacturer was left NZD 32,000 out of pocket.

New Zealand Police's financial crime unit reported the pattern hitting hardware and electronics suppliers across the country, and stopped a shipment of 1,000 computer hard drives from reaching the scammers overseas after freight companies flagged the suspicious emails.

Over three days in April 2026, Microsoft's Defender research team tracked phishing that reached more than 35,000 users at over 13,000 organizations across 26 countries. The emails were sent through real, legitimate email services, so nothing about them looked broken. They were professionally designed, used an urgent "code of conduct" warning to sound like a message from HR, named the recipient's own company in the text, and claimed to be arriving through an official internal channel — some even included a line insisting the message was genuine. Anyone who followed the link landed on a fake Microsoft sign-in page. Signing in there handed the criminals two things: the password, and the already-approved login that signing in created — which they could reuse to get back into the account without having to sign in again.

Microsoft documented widespread account compromise through device-code phishing. The lures were ordinary business themes — invoices, RFPs, shared files, e-signature requests, voicemail and secure-message notices — with generative AI used to tailor them to the recipient's role. Clicking the link opened a page that generated a genuine, live Microsoft device code on the spot and then sent the victim to the real microsoft.com/devicelogin portal to enter it. Everything the victim touched after the email was authentic; approving the code logged the attacker straight into the account.

Across four waves in 2024, attackers emailed Sophos employees PDF attachments containing QR codes. The documents carried company logos, DocuSign-style branding and a deadline — "this document will expire in 24 hours" — and later versions even included the target's own name and job details. Scanning the code opened a fake Microsoft 365 sign-in page that captured the password and the multi-factor code as they were typed. At least one employee was caught. The attacker walked away with their password and their approved login, and tried to use both to get into internal systems.

A phishing campaign copied the notification emails sent by Zix, a real company that businesses use to send encrypted email. The messages were titled "Secure Zix message," repeated the claim in a header, and offered one button to read it. The button downloaded an HTML attachment rather than opening anything genuine. The campaign reached around 75,000 mailboxes, with the sharpest targeting aimed at CFOs, directors and company presidents — the people most used to receiving documents that are supposed to be confidential.

Researchers documented a wave of emails with blank bodies and a PDF attached. Open the PDF and you find an invoice for a few hundred dollars from a brand you recognize — McAfee, PayPal, Geek Squad — for something you never bought, plus a phone number to call and sort it out. Some also carried QR codes. The number does not reach the company. It reaches the criminals, who then talk the caller into handing over information or installing software that gives them access to the computer.

Researchers documented a technique that spread rapidly through 2024 and became known as ClickFix. Emails arrived under ordinary business subjects — one wave posed as GitHub security notifications and reached more than 300 organizations; another used "Important Software Update: Action Required." Some carried nothing malicious at all: no dangerous link, no attachment. What they carried was an instruction. The recipient was shown an error message and a button labeled “Solution” or “How to fix.” Clicking it silently copied a command to the clipboard. Then came the instructions:

1. Press the Windows key and R
2. Press Ctrl and V
3. Press Enter

Three keystrokes, and the victim installed the malware on their own computer. In one version the attackers padded the copied text with a fake “verify you are human” message, so the real command was pushed out of sight in the Run box.

A variant of the same technique dressed itself as the checkbox everyone has clicked a thousand times. Email recipients who followed a link landed on a page reading "Verify You Are Human" — but instead of ticking a box, they were walked through a short set of steps that ended with them running a command on their own machine. Microsoft has since documented the same pattern being used as the opening move in longer intrusions.

Google's Threat Analysis Group documented the Iran-linked group APT42 running phishing built out of borrowed credibility. The attackers wrote under the names of real researchers and journalists, using web addresses like understandingthewar.org and brookings.email — close enough to well-known organizations to feel real at a glance. They often sent a genuinely harmless PDF first to establish trust, then moved targets on to phishing pages and redirects hosted on Google Sites, Google Drive, Dropbox and OneDrive, sometimes via link shorteners, ending at fake Gmail, Outlook and Yahoo sign-in pages. Google says it disrupted the group's abuse of Google Sites across more than 50 similar campaigns in six months.

More than 2,000 UC Berkeley email accounts received a message appearing to come from Chancellor Nicholas B. Dirks. It did not come from Berkeley at all — the real sender was penweltm@miamioh.edu, an account on a completely different university's domain. Attached was a PDF whose link led to a page asking for a username and password. Berkeley's Information Security Office noted one detail in its write-up:

What the header showed

To: (empty)

More than 2,000 people received the same message, and not one of them could see that anyone else had. They had all been blind-copied.

Brown University's Phish Bowl published a genuine message reported by staff. It carried a colleague's name and the opening line every finance team eventually sees: "Hello Are you available? Please I need your assistance urgently." The real sender was zachmile931@gmail.com. Gmail had already put its own banner across the top: Be careful with this message… is similar to a name in your organization, but the email address does not belong to your domain.

Attackers registered a Google Workspace trial and a malicious app, then used Google's own notification system to carry their message. The result genuinely came from Google's own systems and was genuinely sent by Google — there was nothing fake about the sender at all. The text inside claimed Google had received a subpoena to release the contents of the recipient's account, with a link to read more. That link went to a fake Google Support page built on sites.google.com, Google's free site-building service.

Researchers at INKY tracked a sustained campaign of 26,589 malicious emails reaching 5,527 organizations, each carrying an attachment dressed up as a missed-voicemail notification, often with the recipient's own email address in the subject line. The attachment looked like a picture, but this particular kind of image file can also carry instructions that run in your browser — and that is where the criminals hid their code. The files were even mislabeled so that security scanners would treat them as harmless plain text. The sending pattern was broad and untargeted, arriving in waves and largely skipping weekends.

Microsoft tracked an invoice-themed campaign against Office 365 users that ran for more than a year. The attachments were named like this:

Attachment

Payment receipt_4429_18$_Xls.html

Attachment

Contract-1029384756.XLS.html

Read quickly, you see “Xls” and think spreadsheet. The part that matters is the ending — .html — which makes it a web page, not a spreadsheet. The attackers shuffled the capitals as well (xls.HtMl, xsl_x.h_T_M_L) to get past scanners looking for the obvious pattern.

Opening it launched a convincing Microsoft sign-in screen in the browser — loaded from the recipient's own computer, so there was no suspicious web address to notice. To stay ahead of scanners, the attackers re-scrambled how the page was written roughly every 37 days, at one point resorting to encoding parts of it in Morse code.

QakBot campaigns broke into real email conversations and replied inside them, attaching a password-protected ZIP file and putting the password in the message. That combination is the whole trick: because the file is locked, the security tools scanning the email cannot see what is inside it, so the only thing that opens it is a person following the instructions. Researchers have documented the same approach continuing after QakBot itself was disrupted, picked up by other criminal groups and by state-backed ones.

Microsoft documented a finance-themed phishing campaign that hid invisible characters inside normal words. A word like "funding" would be written with something you cannot see wedged into the middle of it, so the message read perfectly to a person while filters looking for that word saw something else entirely.

What you see

funding

What is actually there

fun · ding

The dot is ours — it is standing in for a character that has no appearance at all on screen. The real thing is invisible, which is why reading more carefully cannot save you here.

At its peak on February 26, 2026 the campaign pushed up to 2.37 million messages in a day, run from a cluster of 148 finance-themed sender domains, on strict weekday hours.

Within weeks of the .zip domain ending going on sale, Netcraft found criminals already using it. Live phishing sites included microsoft-office365.zip and microsoft-office.zip aimed at Microsoft users, e-mails.zip aimed at Google users, and login.payment-statement.zip aimed at Okta users. The point is the confusion: ".zip" is something almost everyone recognizes as a file, so an address like that reads as an attachment you were expecting rather than a website you have never visited.

Check Point tracked a campaign that changed the hidden sender information on its messages, so an invitation looked like Google Calendar had sent it for someone the recipient actually knew — the kind of line that reads “Google Calendar on behalf of John Smith.” Around 300 brands were impersonated across more than 4,000 emails in four weeks. The invitations first carried malicious calendar files; when security tools began catching those, the attackers switched to links pointing at Google Drawings and Google Forms instead, so the whole chain stayed inside services people already trust.

Microsoft documented a large credential-phishing campaign running on more than 350 domains the attackers had generated by formula rather than chosen — c-hi.xyz, c-tl.xyz, a-cl.xyz, j-on.xyz, p-at.club, f-io.online, all following the same letter-dash-letters pattern across endings like .xyz, .club, .shop and .online. Mail arrived from a mixture of free accounts, hijacked legitimate domains and the attackers' own generated ones. Links passed through a legitimate site's redirect, then a CAPTCHA page, and finally a fake Office 365 sign-in screen already filled in with the victim's own address.

The Loudoun County Sheriff's Office warned residents about scammers answering online listings from temporary email services — naming Dispostable, GetAirMail, 10MinuteMail, GuerrillaMail, Mailinator and 33Mail. The scam itself was the classic overpayment: the "buyer" sends a check for more than the asking price, asks the seller to wire back the difference, and the check turns out to be worthless days after the money has gone. By then the address that arranged it has expired.

A phishing email sent to the chief executive of a small energy company impersonated the e-signature service DocuSign. The message showed a DocuSign logo, a headline reading “Find disclosures for your review,” and a PDF filename with a file size beside it. None of it was real text. It was all one picture, the filename was just pixels, and there was no attachment to open. There was not a single ordinary link in the message either, so tools that pull out web addresses and check them found nothing to check. But every click, anywhere on that card, went to the same place. And none of the usual checks on where the message came from had run at all — there was simply nothing there to confirm the sender.

Where every click went

done4you.tv

Not a name anyone would have approved if they had been shown it.

An email impersonating the US law firm Alston & Bird LLP arrived as a genuine Google Drive sharing notice, sent through Google's own systems — so every security check passed, because Google really did send it. The trick was in the name itself.

Normal English letter

o

The letter they used instead

о

If those two look identical to you, that is exactly the point. They are different characters from different alphabets, drawn almost the same way. The “LLP” used odd small capitals instead of ordinary ones, too. On screen, the whole name reads perfectly.

Replies were pointed at an address on cloudsecurityaccess.com, a web address created roughly 22 hours before the message was sent, with no website and no working mail system behind it.

Microsoft documented criminals taking advantage of companies whose email settings were loose enough to let outsiders pose as insiders. One example was dressed up as a SharePoint notice asking the recipient to review a shared document. In the inbox, the From line looked like this:

What the recipient saw

From: Pending Approval <you@yourcompany.com>

Their own address, sending them a document to review. The system marked it as internal mail, too.

But the checks that run quietly behind every email — the ones that confirm a message really came from where it claims — all failed. It was like someone wearing your company badge and failing the ID check at the door. The links led on to pages the criminals controlled.

Researchers at Agari followed a Nigerian business email compromise group they called Curious Orca and found the step that comes before the fraud. One associate sent blank probe messages — empty, with no subject at all or just the single letter "i" — to more than 7,800 addresses at over 3,200 companies across at least twelve countries since August 2018. There were two forms, and both look like nothing at all:

Subject

(empty)

Subject

i

No message. No request. No link. Just a test to see whether the address was real.

If one doesn't bounce, the address is live and the person behind it goes into a working list; the group's validated database held more than 35,000 financial controllers and accountants at some 28,000 companies. The invoice fraud comes later, aimed only at addresses already proven real.

A mid-size technology services firm received a "Past due invoice" email whose sender name matched a vendor contact its staff already knew. It passed every security check, because it had genuinely been sent through a real bulk-email service that was allowed to send on that domain's behalf. The body was short and asked for payment to be redirected. The dangerous part was not visible in the message at all.

Shown in the inbox

your vendor’s name

Where a reply would actually go

mail@ilyff.com

That second address sat on a web address the criminals had registered a few weeks earlier. Anyone who hit reply — to confirm the amount, to query the account details — was writing to the attacker while believing they were writing to their vendor. Nobody opens the reply field to check who is on the other end of it, which is the whole reason this works.

Attackers registered ceo-coachinginc.com on March 6, 2026 and used it four days later, writing to a sports-technology company as "Carol Smith, CPA" on behalf of the real firm CEO Coaching International. The email carried a fabricated overdue invoice and named a senior executive at the recipient's own company, so the payment appeared to have been agreed further up. The closing line said this was the last communication before the matter went to a collections agency. Replies were pointed at two addresses the criminals controlled: carol@ceo-coachinginc.com, and admin@azur-email.com on a completely unrelated domain. The message passed every security check — but those checks confirmed an unrelated bulk-mail service, not the company the email claimed to be from.

A Hong Kong precision manufacturing firm was targeted by an impersonation attack built entirely from outside its systems. The attacker registered a lookalike domain and used it the same day, sending a message styled as a reply within an existing conversation. It carried two forged PDFs, including fake bank letters, designed to push a payment to a different account. The message was sent through a completely different email provider from the one the real company uses — something nobody reading the email could possibly see, but obvious in the message's hidden details. The attempt was caught before any funds moved.