Why didn't our email filter catch it?

This is the question we get after a near miss, and it is a fair one. Here is the honest answer.

Email security works by finding indicators: a malicious attachment, a link to a known bad site, a sender that fails authentication, a domain registered yesterday, content matching a known campaign. Business email compromise is designed around having none of those.

What the message actually is: plain text. A couple of sentences about an invoice. Sent from a real mailbox at a real company with a real reputation and perfectly valid authentication, because the attacker is signed into that mailbox. Frequently a reply inside a thread you have been part of for weeks. There is no technical indicator distinguishing it from legitimate mail, because technically it is legitimate mail. It was sent by an authorized session of a genuine account.

What good email security does still catch, and this is not nothing:

• Lookalike domains. The version where they register a domain one character off yours and send from that is catchable, and we catch it.
• The phishing email that starts the whole thing. The fake login page that harvests the password in the first place is a link to a malicious site, and that is squarely what a filter is for. We run Avanan, now branded Check Point Email Security, which sits inside the mailbox rather than in front of it and sees internal mail as well as inbound.
• Display name spoofing, where the name says your owner and the address does not.
• Anomalies in tone and relationship that newer tools score, which helps and is not reliable enough to bet a payment on.

So the filter is worth having and it narrows the problem considerably. What it cannot do is be the last line, because the final email in a BEC chain is specifically built to pass it.

That is the whole argument for a verification rule. Not a lack of faith in the technology, just an accurate understanding of what it can and cannot see. A callback to a number you already had works on a message that is technically perfect, and nothing else does.

If someone sells you an email product on the promise that it stops wire fraud outright, be careful. It reduces the odds. The phone call is what stops the payment.