Personal-email bypass request combined with M&A/urgency indicators

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•0

This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.