A finance clerk receives an urgent email that appears to come from the CEO, requesting a wire transfer to a new supplier account before end of day and asking that no one else be told. The message passed SPF because it came from a look-alike domain the attacker registered. Which control most directly stops this attack?
Select an answer to reveal the explanation.
Short Explanation
Urgency, secrecy, and a new bank account — that's the classic business email compromise recipe. Since the message came from a look-alike domain, your email authentication passed it, so the human process has to catch it. A quick call to a number you already know beats any filter here.
Full Explanation
Business email compromise is a pretexting attack that impersonates an executive, supplier, or partner to trigger fraudulent payments or data disclosure. It often carries no malware or links, relying instead on authority, urgency, and secrecy. When the attacker registers a look-alike domain, the message is legitimately sent from that domain, so SPF, DKIM, and DMARC checks can all pass. The control that defeats it is a process control: verify any payment or banking-detail change through an independent channel, such as calling a number already on file, together with dual approval for transfers. DMARC with a reject policy stops exact-domain spoofing of the company's own domain, but a look-alike domain is a different domain with its own valid records, so DMARC on the real domain never applies. S/MIME encryption protects message confidentiality and does not establish that the requester is genuine. Blocking attachments is irrelevant because the attack is a text request with no payload. Exam caveat: look-alike domain detection and external-sender banners help, but the process control is what stops the money from moving. Operational check: confirm the finance procedure requires callback verification for new or changed payee accounts and test it with a simulated request.