Executive Impersonation ACH Fraud via ServiceNow Invoice Lure

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•4

This rule detects phishing emails attempting to impersonate executive roles (CEO, CFO, President) or using ServiceNow-themed lures (invoices, approvals) to solicit unauthorized ACH or wire transfers. The detection logic focuses on suspicious sender domains, payment-related keywords, and executive-specific titles in the email body.