Full Auth, Wrong Brand: A Phish From the Bank Itself

Every technical signal in this message said it was legitimate. That was the problem.

A card dispute notice branded as American Express landed on a shared support alias at a US commercial bank, the mailbox that handles cardholder dispute correspondence. It arrived from the bank's own corporate domain and transited the bank's own sanctioned mail security gateway. SPF passed, DMARC passed, and Microsoft's composite authentication returned a clean pass at the top of its scale. There was no attacker-registered domain to block and no failed check to alert on.

The only thing out of place was the story the message told.

A Sender Domain That Matched the Recipient Domain

The sending address and the receiving address were the same string: same local part, same domain, a shared alias apparently writing to itself. That changes what kind of incident this is.

It is tempting to read mail from your own domain as proof of a tenant takeover. The record does not support that. There was no DKIM signature at all, and the originating connection came from 5[.]50[.]219[.]139, an address that announced the bank's own hostname in its greeting with no authority to do so. Nothing indicates a mailbox inside the organization was in an attacker's hands. This was a spoof of the domain, not a compromise of an account within it, and the distinction sets the response: you cannot revoke a session that never existed.

Why the Authentication Passed

SPF does not evaluate the message. It evaluates the connecting IP against the envelope sender's published policy. At final delivery that address was 170[.]10[.]132[.]61, the bank's own inbound mail security relay, a sanctioned sender published as permitted in the bank's own SPF record. SPF returned a pass, correctly.

DMARC needs exactly one aligned, passing identifier. With no signature to evaluate, SPF alignment carried the entire result: the envelope domain matched the header sender domain, DMARC passed with no action taken, and the composite score followed at its maximum. Read RFC 7489 closely: none of this is a bypass. The policy was satisfied as written.

The Brand That Did Not Belong

The content belonged to somebody else entirely. The subject announced an automatic adjustment to a disputed card transaction. The body carried an inline card issuer logo referenced from within the message, plus a genuine American Express click tracking link in the footer where a real notice would put one. Everything the recipient could see said card issuer. Everything the mail stack could measure said commercial bank, and there is no relationship between those two parties that would explain the pairing.

That is a clean brand versus sender mismatch, the most reliable tell in the case and precisely the one nothing enforced. Authentication, reputation, and signature matching all read the sender. None of them reads the brand, so the contradiction sits in a layer infrastructure controls never evaluate. The 2024 Verizon Data Breach Investigations Report puts phishing in 15% of breaches and stolen credentials in 38%, and cases like this are why those numbers hold as authentication coverage improves.

The Redirect Behind a Social Shortener

The call to action invited the reader to check the status of the dispute. Underneath it sat a gateway-rewritten URL from the bank's own link protection service, so the domain the recipient hovered over belonged to a security vendor.

The interesting part is the destination parameter the rewriter preserves. It named t[.]co, the link shortener operated by X, formerly Twitter, as the next hop toward the credential harvesting page. A mainstream social shortener is a domain almost no organization will block, since blocking it breaks ordinary browsing, and it removes the attacker's infrastructure from the visible URL. Stack the layers and the click path shows a security vendor in front, a social platform in the middle, and nothing attributable to the attacker until the browser has arrived. CISA phishing guidance puts it plainly: controls built on recognizing bad infrastructure have nothing to recognize when the infrastructure is good.

Where the Template Slipped

The kit gave itself away twice, both times in ways a person notices faster than a filter. First, the greeting arrived doubled: a generic cardholder salutation followed by a second line into which the kit merged the local part of the recipient's own address, in a field meant for a person's name. A real issuer notice addresses the name on the card. This one addressed a mailbox.

Second, the subject line carried a date stamp that did not read right under either convention. Parsed day first, it matches the message's own send time to the second: one instant written two ways. Parsed month first, the default for a US cardholder, it places the disputed transaction months before the email announcing it. That is not a template recycled from an older campaign, and the timestamps matching is exactly why it cannot be. The likelier reading is a locale mismatch: day-first logic rendering a value for a month-first audience. Still an artifact of a kit, and still wrong to the person reading it.

None of the controls this message had already satisfied was going to stop it. Not authentication. Not reputation, which saw a real bank, a real security vendor, and a real social platform. Not attachment analysis: the only object was a logo. The verdict came from meaning: an issuer brand unrelated to the sending organization, a sending domain identical to the receiving one, a personalization field holding a mailbox name, and a shortener hop between the button and the destination. Themis, the Adaptive AI analyst inside the IRONSCALES platform, weighed the combination and resolved the message as phishing automatically.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link for delivery through a wrapped link chained to a public URL shortener.
• T1566 Phishing for the dispute-notice pretext aimed at a servicing mailbox that handles exactly that traffic.
• T1656 Impersonation for the card issuer brand worn over an unrelated financial institution's sending domain.

Closing the Brand Mismatch Gap

Three changes make this attack shape much harder to land.

Compare the brand in the content against the domain that sent it. Every control here graded the sender and none graded the pairing. If a message presents one organization's identity and originates from another's mail domain, that inconsistency has to be a first-class signal. It is where credential harvesting protection earns its keep, since the landing page is only reachable if the framing survives.

Treat mail from your own domain as a spoofing question first. A message from your domain with no signature, connecting from an address with no authority to claim your hostname, is a spoof and not necessarily a takeover. Decide which before resetting credentials, and remember your own gateway inside your SPF record is enough to produce a pass.

Do not let a wrapper end the investigation. A rewritten link makes the visible domain trustworthy while the real destination hides in a parameter. Unwrap it, and hold the shorteners you cannot block to a higher standard than their reputation suggests. That is what phishing analysis has to mean when there is no bad infrastructure left to find. The FBI's 2023 Internet Crime Report puts reported business email compromise losses above $2.9 billion.

The attacker here defeated nothing. Every control worked. Nothing a machine was measuring happened to be false.