Invoice fraud through business email spoofing
A foreign customer paid several invoices into a fraudulent account. Who bore technical responsibility: the supplier or the customer?
Background
For six weeks, a foreign customer of a Catalan industrial company received emails that appeared to come from the supplier, with genuine invoices but altered bank details, and paid them. The customer submitted a technical report blaming an alleged hack of the supplier's servers.
What I was asked
To analyse the fraudulent emails and the opposing report in order to establish the origin of the spoofing.
How it was analysed
- Analysis of the full email headers: originating servers, IP addresses and the Reply-To field.
- Geolocation and comparison of the legitimate and sending servers' IP addresses.
- Check of the registration date of the fake domain used by the fraudsters.
- Critical review of the technical reasoning in the opposing report.
Report findings
The fake emails did not come from the supplier's servers but from a different server and a domain registered on the very day the fraud began. Changing the Reply-To field showed precisely that the attackers did not control the supplier's email.
Key takeaway
Email headers reveal far more than the visible sender. Any change of bank details received by email should always be verified through another channel.
Related service: Expert reports on cybersecurity incidents and computer fraud
Anonymised case. Personal data, the parties and procedural references have been omitted or altered to preserve confidentiality.