Email fraud: was the email intercepted at the sender's or the recipient's end?
Security analysis of a company's email platform (Office 365) after a customer paid invoices into a fraudulent account.
Background
A distributor's customer received a genuine invoice by email and, two hours later, further emails with falsified bank details, and paid into the fake account. The customer blamed a security failure at the sending company.
What I was asked
To analyse the security of the company's email platform and determine where the spoofing had occurred.
How it was analysed
- Review of the cloud email configuration (Office 365 / Exchange Online): antivirus, anti-spam and anti-spoofing protection.
- Check of the SPF records published in DNS.
- Analysis of the IP addresses and server locations shown in the emails.
- Analysis of the timeline of genuine and fake messages.
Report findings
The company's email platform was properly protected. The fact that the customer first received the genuine email and only then the forged ones indicated that the interception happened at the recipient's end, not the sender's. Moreover, SPF is only effective if the receiving server checks it.
Key takeaway
Anti-spoofing measures (SPF, DKIM, DMARC) only truly protect when both parties apply them. The sequence of emails can reveal where the breach lies.
Related service: Expert reports on cybersecurity incidents and computer fraud
Anonymised case. Personal data, the parties and procedural references have been omitted or altered to preserve confidentiality.