This email, including a Word attachment, showed up in my irk Inbox [edited for identity]:
Hi [Johnny L.A.], I am emailing you directly because I haven’t received any reply from your Accounting department, regarding my problem. My credit card has been charged twice by [my company’s domain]
Please refund one of the charges. I am attaching my card statement as evidence.
Sincerely,
[Sender]
- I don’t recognize the name.
- The domain is fake.
- I don’t accept credit cards.
- There is no contact information.
Smells phishy, eh? So I sent a warning to all employees. Then just for grins, I found out how to look at the message header in Outlook and saw this [emphais mine, and edited for identities]:
Message-ID: <7d9d59c7-1c37-4486-9a12-fec1fff53922.2fbad785-4016-4cf2-9eaa-74540244bcf2@injector.psm.[known domain].com>
Return-Path: <noreply@psm.[known domain].com>
Date: Tue, 27 Feb 2024 22:02:49 +0000
From: [Sender Sender] <[Sender]@mailbox-gmail.com>
Reply-To: [Sender Sender] <[Sender]@mailbox-gmail.com>
To: [johnnyla@[company domain]
Message-ID: <65de5c0991214_824a4871c@[IP address].mail>
Subject: double charged
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary=“–==_mimepart_65de5c096d444_824a4870ee”;
charset=UTF-8
Content-Transfer-Encoding: 7bit
> X-PHISH-CRID: 1934240381
X-PHISHTEST: This is a phishing security test from [cybersecurity company we know/use – ‘known domain’, above] that has been
authorized by the recipient organization
X-MS-Exchange-Organization-BypassFocusedInbox: true
If it was a test, I guess I passed it.