Summary: Can email be intercepted and modified by a 3rd-party during transit from the sender to the receiver? If so, can this interception be detected?
- My friend (A) (mailbox at popular freemail example.com) ordered some goods from seller (B) (mailbox at gmail.com).
- B says he mailed pro-forma invoice A. (PDF exported from Excel, all text can be selected by mouse.)
- A did not receive invoice from B, but instead, with 10 hrs delay A received invoice from person C (PDF containing bitmap image looking like invoice from B, with contact and payment information altered to C.) It was sent from mailbox at gmail.com, too. Address of C is like of B, with one letter in long user name removed (example: BBBBBemmaBBBBB@gmail vs. BBBBBemaBBBBB@gmail).
- A did not notice the difference and sent the payment to C. B said no payment was received. C asks for payment tracking number and asks for additional money.
- When investigating, B has re-sent original invoice to A. This time it reached A (first time) and A found it is different from invoice by C. Forwarded (re-sent) message from B also contains text header showing original sending timestamp, but this is weak proof.)
Is B and C the same person, playing double role? Or is there another possible explanation how C could stop sent invoice from B and deliver modified one instead?
Both e-mail providers are large public freemails, so I cannot imagine how step 3 could happen if B was telling the truth (if person B is not C).
(Additional question: what can be done/checked about that?)