CEO fraud, fake suppliers, urgent wire transfers: the hardest email risk to detect is not always address spoofing.
It is the real compromised mailbox.
In this case, the attacker does not just imitate a sender. They use a real account, sometimes belonging to an executive, a supplier, an employee or a partner.
That is precisely what makes the attack so dangerous.
When the email comes from the right address
In classic spoofing, the attacker tries to make it look as if they are sending from a legitimate domain or address.
With a compromised mailbox, the problem changes: the email can really come from the right address.
This means the message can sometimes:
- pass SPF;
- be DKIM-signed;
- pass DMARC;
- come from a known mailbox;
- slot into an existing conversation;
- use the tone and context of the real contact.
For a spam filter, this type of email is much harder to handle. It does not always look like an outside attack. Sometimes it looks like a normal business exchange.
The attacker does not guess, they watch
A compromised mailbox gives time and context.
The attacker can read exchanges, understand processes, identify the right contacts, spot key suppliers, observe payment cycles and wait for the right moment.
The fraud becomes more credible because it relies on real elements:
- a real supplier;
- a real expected invoice;
- a real ongoing project;
- a real contact;
- a real operational emergency;
- a real conversation already under way.
That is what separates these attacks from mass phishing.
Here, the message can be targeted, consistent and sent at the exact moment the company is ready to act.
The most frequent scenarios
Compromised-mailbox fraud takes several forms.
Fake supplier
The attacker uses or watches a compromised supplier mailbox, then sends a request to change bank details.
The message looks legitimate, because it comes from a known contact and can fit into a real business relationship.
The danger is high: the request does not need to look technically suspicious to be fraudulent.
CEO fraud
An executive’s account, or one close to management, is compromised.
The attacker can send a request for a transfer, for confidentiality or for quick action to someone in finance, administration or management.
The lever is usually the same: urgency, discretion, authority.
Access or sensitive information
The request is not always about a payment.
It may target:
- credentials;
- application access;
- a data export;
- HR information;
- internal documents;
- approval of a procedure;
- a link to a fake portal.
Email then becomes the entry point to other risks.
Why SPF, DKIM and DMARC are not enough
SPF, DKIM and DMARC are essential to reduce domain spoofing.
But they do not prove an account is not compromised.
An authenticated email can be sent by an attacker who has taken control of the real mailbox or of an application allowed to send on its behalf.
This is an important distinction:
- DMARC helps check domain alignment;
- DKIM helps check the signature;
- SPF helps check authorised servers;
- but none of these mechanisms guarantees that the business request is legitimate.
In other words: an authenticated email is not necessarily a legitimate email.
Essential checks for IT managers
For a CIO or IT manager, the topic is therefore not limited to spam filtering.
Account behaviour must also be monitored.
Priority points to monitor:
- unusual sign-ins or sign-ins from unusual countries;
- new forwarding rules;
- automatic deletion rules;
- mailbox delegations;
- OAuth access and application consents;
- password changes;
- MFA disabled or bypassed;
- sign-ins over legacy protocols;
- unusual sending volumes;
- changes to signatures or bank details.
These signals should not be looked at in isolation. Their combination is often what reveals the incident.
Out-of-band validation remains essential
For a sensitive request, email must not be the only validation channel.
A bank detail change, an urgent transfer, an access request, a data export or an unusual instruction must be checked through another channel.
Examples:
- a call to a number already known;
- approval in a business tool;
- internal double approval;
- a written procedure for bank changes;
- a check by a different person;
- a ban on approving a sensitive change by email reply alone.
This is not red tape. It is a simple barrier against an attack that exploits trust.
What to do when compromise is suspected
If a mailbox is suspected of being compromised, act fast.
First actions:
- reset the password;
- revoke active sessions;
- check and re-enable MFA if needed;
- remove suspicious forwarding rules;
- check delegations;
- review connected applications;
- analyse sign-in logs;
- search for emails sent during the compromise period;
- warn targeted contacts if needed;
- document the incident and the measures taken.
Also check whether the compromise was used to send messages to customers, suppliers or staff.
The impact can go beyond the mailbox itself.
Conclusion
The most credible frauds do not always come from a spoofed domain.
Sometimes they come from a real compromised mailbox.
That is what makes them hard to detect: the address is correct, the email can pass SPF, DKIM and DMARC, and the message can slot into an existing conversation.
Protection requires combining technical security, account monitoring, business procedures and out-of-band validation.
An authenticated email is not necessarily a legitimate email.
That is often where fraud begins.
To see what DNS configuration covers and what it does not, read our DMARC guide for small businesses or see Dharmail’s domain spoofing protection service (page in French).