Fabricated Invoice Thread BEC Rides a Compromised Mailbox

An accounts-payable alias at a mid-size healthcare services organization received a payment demand for $74,250.00. There was no link to click, no lookalike domain in the header, no macro-bearing attachment, and no authentication failure to point at. The entire attack was a conversation that never happened, pasted into the body of a message sent from a real company's real mailbox. Automated triage looked at it, saw discount language and payment terms, and scored it as promotional bulk mail at 89% confidence. A human analyst read the same message and tagged it as payment-detail fraud.

What Actually Arrived in the Inbox

A first-time sender addressed the organization's shared accounts-payable alias directly. The display name was a department rather than a person, reading as a payment-compliance function, which is exactly the kind of name a real vendor billing desk uses. The envelope and header domain both belonged to a small European travel agency: a genuine business with its own website, customers, and mail hosting. Nothing about the domain was registered for this attack.

Two PDFs were attached, an invoice and a W-9. Both scanned clean, because both were exactly what they claimed to be, ordinary business documents with no active content. There were zero URLs in the message. For every control that looks for a malicious object, there was nothing to find.

The Conversation That Never Happened

The body did not read as a cold approach. It opened as if it were the newest reply in a long-running billing discussion, with three earlier messages quoted beneath it in the familiar stacked format that email clients produce automatically.

The oldest quoted message came from an "Accounts Receivable" persona at a generic consultant mailbox, presenting a past-due balance and offering a 10% reduction for settling promptly. The next quoted message was the one that mattered: a reply attributed to an internal finance approver, using an address at the recipient organization's own domain, agreeing to release the payment and instructing that the invoice and a W-9 be routed to accounts payable for processing. The outer message then simply did as it was told, arriving at the accounts-payable alias with the paperwork attached and the air of weeks of settled back-and-forth behind it.

That structure inverts the usual social-engineering pressure. Nobody in the chain asks the accounts-payable clerk to make a decision. The decision has apparently already been made, by a colleague, further up. The clerk's only remaining task is administrative, and the attachments make it feel like the last step of a process rather than the first step of a request.

It is worth being precise about the W-9, because the direction of that document is commonly misread. The sender was supplying its own tax form to the target's finance team, the way a new vendor does during onboarding, not asking the victim to disclose a taxpayer identification number. The paperwork was there to make the payee look legitimate, not to harvest data.

The Forgery Kept Bad Books

The forgery carried one internal inconsistency, and it is the sort a busy clerk would never notice. The invoice number quoted inside the fabricated thread text (INV-xx-1148MA) did not match the invoice number on the file actually attached to the message (INV-xx-0209MA.pdf). The conversation and the paperwork referred to two different invoices.

That mismatch is a fingerprint of volume. Operators who run invoice fraud at scale keep a reusable block of thread text and swap the attachment per target, or swap the target and forget the text. It is production drift rather than a deliberate clue, and it is one of the few artifacts here a reviewer can check without leaving the mail client.

Why Authentication Reported Everything Was Fine

SPF passed. There was no DKIM signature at all, because the sending environment does not sign outbound mail. DMARC returned a best-guess pass, which is what happens when a receiving platform infers alignment for a domain that publishes no explicit policy of its own, and composite authentication passed on that same implicit basis.

None of that was a spoofing failure. The submission headers show the message was handed to the domain owner's own outbound service by a client that had authenticated as that mailbox, which is why the path checks were clean. The tell is where that client sat. The authenticating IP address had no relationship to the hosting range the domain normally sends from. That is the signature of vendor email compromise, stolen mailbox credentials used from somewhere else, with every authentication record faithfully confirming that the real account sent the mail. As RFC 7489 describes it, alignment is a statement about domains, not about whether the human at the keyboard is the account owner.

See Your Risk: Calculate how many threats your SEG is missing

Why Automated Triage Read It as Bulk Mail

The platform's automated triage bucketed this message as spam with 89% confidence, and the reasoning is legible. Every content signal it surfaced was a bulk-mail signal: promotional and attention-grabbing phrasing, similarity to messages the community had previously reported as spam, and sending behavior consistent with mass-mailing patterns. Those signals were not wrong about the message's surface. Discount offers and payment-terms language really do cluster with marketing mail, and an operator working many targets really does behave, statistically, like a mailer.

What the label missed was the target. A promotional-sounding note delivered to one shared finance alias, quoting an internal approval that authorizes a five-figure transfer, is not bulk anything. Themis, our Adaptive AI analyst, surfaced the content and sender-behavior evidence that made the message reviewable, and a human analyst supplied the judgment that reclassified it, applying a payment-detail fraud tag and quarantining the one affected mailbox. That division of labor is the point.

What Detection Has to Key On When There Is No Payload

The 2024 Verizon Data Breach Investigations Report puts pretexting, largely business email compromise, at the top of the social-engineering category, with a median transaction near $50,000, and finds the human element present in 68% of breaches. The 2023 FBI IC3 Internet Crime Report tallies roughly $2.9 billion in reported business email compromise losses. None of that damage requires malware, and neither did this message.

Three checks do most of the work here, and all three are cheap. First, treat any claim of prior internal approval as falsifiable: search the mail store for the thread the message says it is continuing, and if the approving reply exists nowhere except inside the message that depends on it, the approval is fabricated. Second, compare the body against the attachment before paying, since a quoted invoice number that does not match the attached file is a decisive contradiction. Third, verify payment instructions out of band on a phone number already on record, a control both CISA phishing guidance and the NIST definition of phishing point back toward. Layered business email compromise protection that scores relationship history and sender novelty, rather than only objects and reputation, is what turns a message like this into an event a human looks at.

Indicators of Compromise

MITRE ATT&CK Mapping

The uncomfortable lesson is that this message was cheap. One set of stolen mailbox credentials, two ordinary PDFs, and a block of invented conversation produced a credible five-figure payment request that every object-level control passed and an automated classifier filed as marketing. There was no infrastructure to block and no indicator to blacklist that would not also block a legitimate small business. What stopped it was a review of who was asking, for what, and whether the approval they cited existed.