I'm trying to understand how this user impersonation might have taken place. Here's the scenario:
Our controller got a call from our bank this morning about a suspicious wire transfer request. After some back-and-forth with the controller and with the bank, we've established that this is what happened:
Somebody sent an email to the bank requesting a wire transfer using an old domain of ours: [email protected]. This is an old domain that we used to use for email and which we still own. Email service is still set up for this domain, however all email address have been replaced with aliases that forward email to addresses at our new domain.
The bank replied with instructions & a form to complete.
The bad guy sent back the form, completed and signed, from a hotmail address. The bank may also have spoken to the bad guy - that's not clear to me (since I'm getting the information second hand).
The bank called us (at our phone number on record) to confirm the transaction.
The question I have is this: how did the bad guy get the email which the bank sent? We have checked the logs for both our email systems (both old and new) and there are no recorded visits from any unusual IP addresses.
I think it was a simple "reply-to" header on the original email, and the person at the bank didn't notice that the reply was being sent to a different email. But shouldn't the bank have something in place to alert the user if the "reply-to" address is different from the "from" address?
My co-worker thinks the only other possibility is the bank's DNS record being hacked to redirect outgoing email. That seems highly improbable to me - is it possible that the bank's DNS record was hacked?
Finally, are there other ways for this to work?