Is the following e-mail fraud technically possible?

Question

Summary: Can email be intercepted and modified by a 3rd-party during transit from the sender to the receiver? If so, can this interception be detected?

Details:

1. My friend (A) (mailbox at popular freemail example.com) ordered some goods from seller (B) (mailbox at gmail.com).
2. B says he mailed pro-forma invoice A. (PDF exported from Excel, all text can be selected by mouse.)
3. A did not receive invoice from B, but instead, with 10 hrs delay A received invoice from person C (PDF containing bitmap image looking like invoice from B, with contact and payment information altered to C.) It was sent from mailbox at gmail.com, too. Address of C is like of B, with one letter in long user name removed (example: BBBBBemmaBBBBB@gmail vs. BBBBBemaBBBBB@gmail).
4. A did not notice the difference and sent the payment to C. B said no payment was received. C asks for payment tracking number and asks for additional money.
5. When investigating, B has re-sent original invoice to A. This time it reached A (first time) and A found it is different from invoice by C. Forwarded (re-sent) message from B also contains text header showing original sending timestamp, but this is weak proof.)

Is B and C the same person, playing double role? Or is there another possible explanation how C could stop sent invoice from B and deliver modified one instead?

Both e-mail providers are large public freemails, so I cannot imagine how step 3 could happen if B was telling the truth (if person B is not C).

(Additional question: what can be done/checked about that?)

Answer 1

Plenty of things could have happened.

To start with, emails which are not digitally signed cannot be trusted:

• they can be tampered with in transit (not very likely when the exchange is between two large providers)
• the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach it (if the headers were available, which is usually not the case with webmail providers))

So we do not know who sent which email (B, C or someone else). This is not interesting enough for an authority (police or other) to get involved so the hope to find out is close to none.

Now the sending itself: we do not know whether B's account is secure. Maybe C got access to it. From there on he can do plenty of things, including catching outgoing emails, redirecting incoming ones etc.

So to summarize: we do not know what happened and will not know, even by looking closely (especially if this is webmail from larger providers). The only reasonable thing which B can do is to change his credentials and review his filters (in the webmail system). And your friend to use an escrow system for payments, if available.