BEC Attack: CFO Wire Request — Writing Style Deviation Detected
Email from CFO account requesting $285K wire to new vendor account shows 94% writing style deviation from baseline. Sent at 11:47 PM from unfamiliar device in Eastern Europe. Vendor banking details changed 2 hours prior.
Summary
A Business Email Compromise attack targeting CFO email account detected via writing style analysis, device fingerprint mismatch, and vendor payment change correlation. Pattern matches FBI IC3 BEC typology — $3B+ in annual losses.
Evidence Chain (4 items)
CFO email requests urgent $285K wire transfer to "updated" vendor account. Writing style scores 94% deviation from learned CFO baseline.
Source: Microsoft 365 — Email Analytics | Ref: MSG-2026-EML-88421
Email sent from IP 185.xx.xx.42 (Kyiv, Ukraine) — device not in CFO known device registry
Source: Azure AD | Ref: AUTH-2026-99812
Vendor Acme Corp banking details updated to new account 2 hours before wire request
Source: Workday Financials | Ref: VND-CHG-4418
Wire request marked "URGENT — process before end of business" — pressure language detected
Source: RiskRadar NLP Engine | Ref: NLP-URGENCY-0092