The FedEx Bill That Never Linked to FedEx

A billing notice landed in a shared accounts payable alias at a facilities services company asking for $58.80. The subject line read like a monthly statement. The display name said FedEx. The body carried courier branding, a ten-digit account number, a balance due, and the instruction every accounts payable clerk has followed a thousand times: sign on, click view, click pay. Directly beneath that instruction it printed the portal address, www[.]fedex[.]com/officebillingonline.

Nothing was linked to that text. Not a redirect, not a wrapped URL, not a lookalike host standing in for the real one. The platform captured exactly three clickable elements in the entire message, and all three were Microsoft's: the support and documentation destinations that Microsoft 365 injects into its own external sender caution banner. All three scanned clean, because all three genuinely belonged to Microsoft. The courier payment page the email told the recipient to visit was never more than a string of characters on a screen.

Authentication That Only Vouched for the Sender

The message passed. SPF returned a pass for the envelope domain mail[.]usdelivery[.]org from connecting IP 205[.]251[.]167[.]67. There was no DKIM signature at all, because the message was never signed. DMARC passed anyway, on SPF alignment, because the From header also read mail[.]usdelivery[.]org. Composite authentication came back with a pass and a reason code of 100, the strongest verdict Microsoft's own stack issues.

Read that chain again and notice what it never touches. Every verdict in it describes usdelivery[.]org. The apex domain was registered more than two decades before this message was sent, through a European registrar, with no registrant name or organization disclosed. It even publishes a strict reject policy of its own, which is the part worth sitting with: the operator maintains disciplined authentication hygiene on the domain they use to impersonate somebody else. Their record keeping is immaculate. It simply has nothing to do with the courier whose name appears in the display name, and the specification behind those checks, RFC 7489, never claimed otherwise. Alignment is measured between the authenticated domain and the From domain. A brand is not a domain. A brand is a word a human recognizes, and no authentication result in that header block was ever asked to evaluate it.

The Payment Portal That Was Never There

Display text that disagrees with its destination is a familiar pattern, and it is at least tractable. A visible label pointing at an attacker host still yields a domain to block, a page to detonate, a reputation score to consult. This message offered less than that. The visible label pointed nowhere, so there was nothing to evaluate.

That absence removes an entire category of control from play. URL rewriting has no URL to rewrite. Sandbox detonation has nothing to detonate. Link reputation scoring returns three clean Microsoft verdicts and, read naively, makes the message look safer than a message with no links at all. The recipient supplies the missing hop themselves, by typing the address, searching for the brand, or scrolling four lines down to the alternatives.

See Your Risk: Calculate how many threats your SEG is missing

Payment Channels With No Digital Surface

Those alternatives were entirely analog. The body offered a mail-in option, a PO Box in Dallas presented as the courier's billing lockbox, and a toll-free number to call about the balance. It also quoted a genuine courier support address, caswebmaster@fedex[.]com, as a contact of record, borrowing a real and verifiable artifact to raise the plausibility of everything around it.

Both channels sit outside email entirely. A clerk who mails a check has left the perimeter. A clerk who calls the number is having a conversation no email control can observe, transcribe, or score. The 2024 Verizon Data Breach Investigations Report puts pretexting, mostly business email compromise, at the top of the social engineering pattern, and the human element in 68 percent of breaches. This is what the top of that pattern looks like once an operator strips out every technical artifact: a plausible request, a familiar brand, and two ways to pay that a scanner will never see.

Small Enough to Clear Without a Question

The amount is the most deliberate choice in the message. The same report puts the median transaction in a business email compromise incident near $50,000, and the 2023 FBI IC3 Internet Crime Report counts roughly $2.9 billion in reported losses from that category. Requests at that scale collide with approval workflows, dual authorization, and someone asking a question.

A statement for $58.80 collides with nothing. It is smaller than the cost of investigating it. Sent to a shared supplier invoice alias rather than a named owner, it lands in a queue where no individual owns the judgment call, and where a small recurring courier bill is one of the most ordinary objects that can arrive. The attacker is not trying to win big once. The attacker is trying to be boring.

The Same Statement, Over and Over

It was boring on purpose, and it was repeated. The identical subject template, including its fixed reference token, arrived at the same mailbox in four separate months, and each instance was quarantined. That is a maintained operation working a list rather than an opportunistic one-off, and the repetition is itself a tell: a genuine courier statement against a real account does not carry the same unchanged reference string every cycle.

With no link and no attachment, detection had to rest on everything except the payload. Themis flagged the incident at 77 percent confidence and it was automatically resolved as phishing, with the affected mailboxes quarantined. The automated classification leaned toward a credential-focused verdict, which the message does not really support, since there was no sign-in page anywhere in it. What mattered operationally was the rest of the picture: a sender with no history with this recipient, a sending domain with no association to the brand it presented, a shared alias as the target, and a template that had been seen here before.

What to Watch For

An authentication pass is a statement about a domain and never an endorsement of a brand, and a display name is unauthenticated text that anyone can type. Treat a printed portal address as a claim rather than a link, and check whether the visible address is actually wrapped in a working destination, because plain text in that position is a deliberate evasion and not sloppiness. Treat a mail drop or a phone number offered as a payment path as a signal in its own right, since both move the transaction somewhere email controls cannot follow. And weight low-dollar recurring invoices to shared aliases higher than their face value suggests, because business email compromise at this size is engineered to clear on the strength of being unremarkable. Guidance from CISA and the NIST definition both frame the target as the person rather than the payload, which is exactly where this message aimed.

Indicators of Compromise

MITRE ATT&CK Mapping