After a successful phish, a vendor-payment thread is sent from the city comptroller's real mailbox asking a contractor to change the ACH destination. Which term best describes this activity?

After a successful phish, a vendor-payment thread is sent from the city comptroller's real mailbox asking a contractor to change the ACH destination. The best term is email compromise that uses the legitimate civic mailbox to run a BEC-style fraud. Civic framing matters because comptroller mail is trusted by vendors; fraudulent ACH change requests from a real municipal mailbox are business email compromise abuse, not a new malware family invented to explain the thread.

Calling it a new ransomware family encrypting the comptroller's workstation fails by concept: ransomware is destructive encryption for extortion, and the described activity is fraudulent payment diversion from a live mailbox. Labeling it a botnet of licensing kiosks flooding the payment portal fails by concept: a botnet flood is many compromised hosts attacking availability, not a single authentic mailbox steering ACH. Calling it a denial-of-service against the city's outbound mail gateway fails by concept: DoS would impair sending capacity, whereas the fraud depends on successful delivery of the malicious thread.

Exam caveat: SPLK-5001 expects email compromise / BEC-style abuse when the attacker uses a real civic mailbox for fraud—do not invent ransomware, botnets, or mail-gateway DoS when the evidence is a fraudulent payment thread from a compromised inbox.

Operational check: Confirm the thread originated from the comptroller mailbox after phish, freeze related ACH changes with finance, remove malicious rules and sessions, warn the contractor on out-of-band channels, and classify the incident as email compromise enabling BEC-style fraud.