2

My relative received an email from a bill they were expecting to pay. So they paid said bill.

Only problem is: it was a spoofed email, and the real bill only came in later.

I checked the email on the email platform (Outlook) and there was no indication that it was a spoofed email. I checked the email source code, and I verified the spoofed email did not pass Dkim nor Dmarc tests. Authenticated sender field was different than the From: field.

But it passed SPF test (domain of abc.com designates XXX.XXX.XXX.XXX as permitted sender, however, abc.com is the domain of the hacker, not the company's domain), so Outlook still accepted the email.

Is the billing company that was impersonated liable in this case, because it was an outside hacker that sent a spoofed email, but it seems the email was validated by their SPF test and their server was not configured to invalidate such email.

Improve this question
8
  • Does company represent your mail provider, or the company that was impersonated? In any case, SPF, DKIM, DMARC, are more of security features someone may implement to reduce spoofing than a contractual obligation. Of course, it depends on the contract you have with the other parties.
    – Yuriko
    Commented Dec 8, 2022 at 15:26
  • company is the billing company, that was impersonated...
    – Bersan
    Commented Dec 8, 2022 at 15:53
  • "SPF, DKIM, DMARC, are more of security features someone may implement to reduce spoofing than a contractual obligation" if that's the case, it is not viable to use email anymore, and we should go back to physical mail, right? Because then no email we receive can be trusted
    – Bersan
    Commented Dec 8, 2022 at 15:54
  • Do you consider physical mail to be more secure? From experience, these mechanisms are implemented to reduce risks, not to engage in any additional liability. Moreover, it is your email provider that delivered to you an email that failed DKIM and DMARC tests.
    – Yuriko
    Commented Dec 8, 2022 at 15:59
  • In your last sentence, if 'the company' refers to the impersonated company and 'their' also refers to the impersonated company, then the answer to your question is no - because these spoofed emails never passed through the impersonated company's mail servers. They were sent directly from the spoofer's outgoing mail server to your relative's incoming mail provider (Outlook). However, you could argue that Outlook could have done a better job at flagging this message as suspicious, being that the envelope sender (which SPF is based on) did not match the sender in the message header.
    – mti2935
    Commented Dec 8, 2022 at 16:13

1 Answer 1

Reset to default
1

A scam like that is a crime, and what happens with those is out of scope here. It is the fault of the criminal. But answering the question this implies: what is one supposed to do about it?

First, advise users that while they can trust the bill notification, the payment link is best not used. There are two options to pay the bill online:

  • Type the URL of the biller's website (or use a bookmark), check the bill amount, and pay it there
  • Add the biller as a recipient or e-bill in online banking (using information the bank provides, information from a mailed bill, or information from a bill downloaded from the biller's website, not from email), and pay the bill there

This will fix the problem. Your relative will not get scammed by this again if they do this. It's equivalent to a commonly used control in corporate accounts payable departments to avoid exactly this type of scam.

Second, you didn't post the SPF policy, and it sounds like it's wrong and the company should reconfigure it.

Third, spam detection is a guess, not a hard and fast rule, and although it is silly and needless, many senders will send important mail with broken security headers. But one could argue Outlook's spam filter could be improved here.

Improve this answer
1
  • I agree that any payment request via email should be treated with suspicion. On your "second" argument: Even without posting the exact SPF policy, we can determine the check passed, "on the domain of the hacker". So, SPF of the company was not the issue. On your "third": Spam detection can seem like a black box. But is simply a rating system where certain factors increase the likelihood of a message being SPAM. Outlook detected the email as being SPAM and placed it in the JUNK folder, as the OP commented. While SPAM detection may be opaque, in my opinion Email Authentication is not.
    – Reinto
    Commented Dec 13, 2022 at 12:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .