First-time sender requesting financial reference data despite passing authentication

Ethan Andrews@eandrews

•updated Aug 4, 2026•2•0•8

Detects potential business email compromise or phishing attempts by identifying inbound emails that pass authentication checks but involve a first-time sender-recipient pair (no correspondence in 90 days) referencing financial themes such as invoices, bank accounts, or purchase orders.