Accounts payable at the county construction office receives an email from what looks like a long-time vendor asking to redirect the next progress payment to a new bank account. The From domain is one character off the real vendor domain. Which attack best matches this scenario?
Select an answer to reveal the explanation.
Short Explanation
One wrong letter in the vendor domain plus a "send the check here instead" ask is textbook BEC with a lookalike domain. It is payment fraud by brand impersonation, not a phone-only scam or a USB drop. Always verify bank-change requests out of band.
Full Explanation
Business email compromise (BEC) with a lookalike or typosquat domain is payment fraud by brand impersonation. Accounts payable sees a familiar vendor narrative and a one-character domain change that often slips past casual visual checks. The goal is to redirect a legitimate progress payment to attacker-controlled banking details. Municipal construction offices are frequent targets because large, routine vendor payments create predictable windows for "updated wiring instructions."
Vishing that uses only a live phone call does not match: the lure arrived as email from a forged-looking From domain, not as a spoken conversation with no mail involvement. Voice coercion is a related social-engineering family but a different vector here.
A watering-hole compromise of a procurement forum would infect visitors who browse a trusted site. The county office was not browsing a poisoned forum; it received a targeted payment-change message over email.
A USB parking-lot drop delivers malware through removable media curiosity. That vector introduces code execution risk on endpoints, not fraudulent ACH or check redirection through a lookalike vendor domain.
Exam caveat: BEC can use spoofed display names, compromised real vendor mailboxes, or lookalike domains. When the stem emphasizes a domain one character off plus a payment redirect, map it to BEC/typosquatting rather than generic phishing or malware delivery. Payment-fraud BEC often has no malware payload at all.
Operational check: freeze any bank-account or remittance change until verified out of band using known vendor contact data from a master vendor file—not reply-to on the suspicious message. Compare domains character-by-character, enable DMARC/DKIM/SPF monitoring for vendor-impersonation patterns, and require dual control for high-value municipal disbursements.