How Can We Protect Against Phishing Emails That Look Legit?

Have you set up any impersonation filtering? That might help with these types of phishing attempts. Just keep in mind that Microsoft filters often miss checking the CC field, which leaves a gap for attackers to exploit.

I totally feel you on this. We’re facing the same kind of issues, and honestly haven’t found a solid solution yet. It seems like these tactics are becoming more common.

Just to clarify, are they actually spoofing your domain? We only allow emails from our own domain (@companyname.com) and flag any external emails clearly. But it sounds like that's not what's happening here. It appears that the attacker crafted a long email thread to make it seem legitimate, with seemingly innocuous involvement from a fake CFO.

We haven't found a technological solution yet either. After a recent close call, we did implement a policy requiring finance and HR to verify new account details through a separate communication method. While this doesn't prevent initial phishing, it definitely reduces risk.

Using services like Avanan could help, as they claim to have better measures against impersonation attempts. Many email security systems mainly focus on the 'From' and 'To' fields, but it’s crucial to check the CC field too. If possible, can you confirm whether Avanan addresses this?