Lookalike monitoring after a €150,000 loss

Already happening to you? Report a live attack. Reporting is free and needs no account.

What happened in 2023

In early 2023, attackers broke into the email account of an employee at a specialty pharmaceutical company. They used it to write to one of the company's clients about a payment that was due, and sent the client to a website showing fake payment instructions.

The client had no reason to doubt an email from an address it already knew. It transferred €150,000 to a Portuguese bank account opened under a false name. The money was then moved on through several accounts in other countries, which made getting it back far harder.

The company deals with clients, resellers, researchers and suppliers every day, and sends confidential information and large payments by email. That makes its email valuable to an attacker, and one fake payment instruction harms its standing with everyone it works with.

What the company asked us to do

Attacks like this can come with lookalike domains and fake payment pages that copy the same company. The company later brought in DefendDomain to watch for those:

• We check lookalikes of the company's web addresses every hour, and alert the company when one is registered, gets a website or is set up to send email.
• If one is used against it, such as a fake payment-instruction site, we send the evidence to the companies that can take it down and follow up with them.

We do not protect a real mailbox that has been broken into. That needs email security and account protection, such as two-step login. If a customer may already have paid the wrong account, our guide on what to do when someone is impersonating your company covers the first steps.