A New York ecommerce brand almost wired $25,000 to a criminal who had slipped into an email thread with their own supplier.
In late 2021, the brand paid a trusted manufacturing partner by wire. An attacker, posing as that partner from a domain that dropped a single letter, joined a live purchase-order thread and sent new banking details to reroute the next payment. The client's team paused the wire before it went out, and we ran the forensic investigation that proved what happened, where the compromise started, and who was behind it.
The Challenge
The brand ran purchase orders and payments with a manufacturing and supply partner over ordinary email. Invoices, pickup schedules, and payment questions all moved in the same threads, so a supplier message about banking details looked like business as usual.
As a fast-moving ecommerce company, the brand paid suppliers by wire on a recurring schedule, with real money due on real deadlines. A single rerouted payment could send tens of thousands of dollars to an account they would never get back.
When a supplier contact suddenly asked for payment to a new account, the only question that mattered was simple and hard. Was this really the supplier, or someone impersonating them?
Payments ran over email
Purchase orders and payment details were handled in email threads, so a request to change bank details did not look out of place.
A near-perfect impersonation
The fraudulent emails came from a domain one letter off the real supplier, carried the right names and signatures, and were sent from a real mail server, so spam filters let them through.
Real money on a real deadline
A live purchase order had a payment due, so a wrong move meant a $25,000 wire landing in a criminal's account.
What We Found
We collected and hash-verified 17 messages from the thread, analyzed the full headers of each, and ran domain and hosting lookups on the addresses involved. That let us rebuild the attack minute by minute and show where it started.
The compromise started on the supplier's side, not the client's
The attacker had full context of a real, ongoing purchase-order conversation, which meant they were reading the genuine thread. The proof came late in the exchange. When the client re-added the supplier's real sales address to the thread, the attacker's very next reply silently removed it and kept only lookalike addresses. That behavior only makes sense if the interception was happening on the supplier's side.
The client was the target, but not the point of failure. The attacker was positioned to run the same play against every customer of that supplier.
A lookalike domain registered just in time
The fraudulent domain dropped a single letter from the supplier's real domain. It was registered within about a day of the supplier's genuine reply in the thread, and the first fraudulent email arrived roughly ninety minutes after the domain went live. The server behind it sat in Manchester, in the United Kingdom.
The timing shows a prepared, opportunistic operator who stands up new infrastructure the moment a live money conversation appears, then moves fast while the thread is still warm.
One serial actor behind 167 fraudulent domains
The registrant behind the lookalike domain had used the same handful of email addresses to register 167 fraudulent lookalike domains dating back to October 2018, hosted mostly in the United Kingdom and Germany. The payment in this case was pointed at a money-mule account newly opened in Florida, with onward routing overseas.
This was not a one-off. It was one run of an established fraud operation that recycles the same methods and infrastructure against a wide range of victims.
The payment that almost went to a criminal's account
Posing as the supplier, the attacker wrote that their finance team had new banking details and that all future payment should go by wire to a different account. The next scheduled wire, $25,000, was due to go to that account.
Two signals gave it away. The sending domain was one letter short of the supplier's real domain, and when the client's team put the supplier's genuine sales address back on the thread, the attacker's reply quietly stripped it out again. Header analysis across all 17 messages confirmed the real and fraudulent paths.
The client's team paused the wire to confirm the change internally before releasing funds, and no money was transferred. The lesson applies to every business that pays by wire. A change of bank details is never verified by replying to the same email. It is verified by a phone call to a known number, out of band. Our guide on what to do when a vendor email asks for new bank details walks through the steps.
How the real supplier and the attacker differed
| Signal | Real supplier | Attacker |
|---|---|---|
| Sending domain | Correct spelling | One letter removed |
| Supplier's real sales address on the thread | Present | Removed on the next reply |
| Request | Normal purchase-order replies | New bank account for all payment |
What We Delivered
We moved in as the incident response and forensic team the moment the client flagged the suspicious thread, confirmed the wire had not left, then ran a full email forensic investigation, attributed the attack, and referred it to law enforcement.
Incident triage and containment
Confirmed the suspect banking change was fraudulent and the wire had not been sent, and advised on holding and verifying the payment before any funds moved. See our business email compromise response and incident response services for details.
Email forensic investigation
Collected and hash-verified 17 messages, analyzed the full headers, and reconstructed the attack to pinpoint that the compromise originated on the supplier's side. See our digital forensics service for details.
Attribution and threat intelligence
Linked the lookalike domain through registration and hosting data to one serial actor behind 167 fraudulent domains since 2018, and mapped the overseas infrastructure and the Florida mule account. See our digital forensics and dark web and domain monitoring services for details.
Law enforcement referral
Prepared and filed an FBI IC3 complaint with the full domain list, message headers, and recipient-account details so the activity could be tracked across its many victims. See our business email compromise response service for details.
Results
All numbers come from the client's own email records, the message-header forensic analysis, and the IC3 complaint filed for this incident.
The client's team paused the fraudulent wire and verified the change before any money moved.
The exact amount the attacker tried to reroute to a mule account.
Forensics tied the lookalike domain to one actor's 167 fraudulent registrations since 2018.
Every message was hash-verified and header-analyzed to prove where the compromise began.
Timeline
From a hijacked purchase-order thread in late 2021 to a confirmed zero-loss outcome and an FBI referral, start to finish in under two weeks.
A real purchase-order thread
The brand and its supplier trade normal messages about a purchase order and payment.
A lookalike appears
Within about a day of the supplier's genuine reply, the attacker registers a domain one letter off the supplier's and, roughly ninety minutes later, joins the thread posing as the supplier.
New banking details
Still posing as the supplier, the attacker sends updated bank account details and asks that all future payment go to that account.
The catch
The client's team pauses the next wire to confirm the change internally instead of replying to the email, and the payment never goes out.
The tell
The client re-adds the supplier's real sales address to the thread, and the attacker's next reply silently removes it, confirming the compromise was on the supplier's side.
No wire sent
The date the fraudulent $25,000 wire was due passes with no payment made.
Investigation and referral
We complete the forensic report, attribute the activity to a serial actor, and file an IC3 complaint.
Awareness that sticks
The brand and its team now treat any emailed change of bank details as a red flag to verify by phone, out of band, before any payment moves.
Services Applied in This Engagement
This engagement combined business email compromise response, email forensics, and attacker-infrastructure intelligence to prove exactly what happened in a live wire fraud attempt.
Business Email Compromise Response
Rapid triage when a payment-change request or hijacked thread is already in motion.
Learn moreDigital Forensics
Message-header analysis and attribution that prove where an attack started and who was behind it.
Learn moreEmail Security
Stop business email compromise and lookalike-domain fraud before it reaches your team.
Learn moreWould Your Team Catch a Supplier Who Suddenly Changed Their Bank Details?
Business email compromise does not break in. It waits inside a thread you already trust and asks you to pay the wrong account. We help you verify payment changes, spot lookalike domains, and respond fast when something is already in motion.
We work with ecommerce brands, consumer-goods companies, and any business that pays suppliers by wire. Start with a free consultation.