<\/span><\/h1>\nEmail impersonation attacks<\/strong> occur when attackers craft messages that appear to come from someone trusted (an executive, vendor, partner, or internal team member) to deceive recipients \u2014 often to steal money, credentials, or sensitive data. These include:<\/p>\n\n- Business Email Compromise (BEC)<\/strong><\/li>\n
- Display\u2011name spoofing<\/strong><\/li>\n
- Exact domain impersonation<\/strong><\/li>\n
- Look\u2011alike domains (e.g., \u201cpaypa1.com\u201d instead of \u201cpaypal.com\u201d)<\/strong><\/li>\n<\/ul>\n
Because they leverage trust and social engineering rather than malware, they\u2019re harder to detect<\/strong> with basic tools alone.<\/p>\n
\n<\/span>\u00a0Immediate Response: What to Do First<\/span><\/h1>\nWhen an impersonation attack is detected or suspected:<\/p>\n
<\/span>Isolate and Contain<\/strong><\/span><\/h2>\n\n- Quarantine the email thread<\/strong> and block further distribution.<\/li>\n
- Disable links and attachments<\/strong> in the email to prevent accidental clicks.<\/li>\n
- If systems (e.g., mailboxes or accounts) are compromised, isolate those accounts<\/strong> until secured.<\/li>\n<\/ul>\n
<\/span>Preserve Evidence<\/strong><\/span><\/h2>\nPreserve all digital records for investigation:<\/p>\n