The most expensive email fraud there is arrives with a valid signature from a domain that genuinely owns it. Every control in this track passes it, correctly, because there is nothing about the message that is false except its purpose.
The shape
A supplier's finance mailbox is compromised. The attacker reads months of real correspondence. They reply, in thread, to a genuine invoice discussion, from the genuine address, with new bank details. SPF pass, aligned the supplier's own servers DKIM pass, aligned the supplier's own key DMARC pass everything is exactly as claimed Thread continuity, writing style, context: all genuine.
Nothing was spoofed. The authentication is not being defeated — it is reporting accurately that this message came from the supplier, which it did.
Why it defeats the whole stack
- Authentication answers “who sent this”. The answer is correct and is not the question that would have caught this.
- The content is indistinguishable because it was written using months of real context.
- There is no anomalous infrastructure — the mail comes from the servers it always comes from.
- Reputation systems see a trusted correspondent, because that is what it is.
What actually works
- Out-of-band verification for payment changes. A phone call to a number held on file — not one from the email. This single control stops the entire category and is a process rather than a technology.
- Dual authorisation above a threshold. Two people, one of whom was not in the email thread.
- MFA everywhere, which addresses the compromise rather than the message.
- Treating any change of bank details as an event, regardless of how ordinary the request looks.
Say this before anyone asks
A programme presented as stopping email fraud will be judged against the incident that eventually happens, and it will be this one. Stating at the outset that authentication addresses impersonation and not compromise — and naming who owns the controls that do — is the difference between a programme that succeeded and one that is blamed.