Back to All Attacks
Attack Details
Attack Date:
May 20, 2022

Vendor Impersonation Payment Inquiry BEC Attack

Initial Email Content

Subject
Re: Fw: Re: PWC LLC: #1691134
Body

Please advise once payment has been made so I can confirm with my AR department that it has been received. Once we have received payment, we will be able to update our records..


Thank you,


[Vendor Employee Name], CPA

Chief Financial Officer

PwC network.



PricewaterhouseCoopers LLP

411 Hamilton Boulevard

Peoria, Illinois 61602

United States



On Fri, May 20, 2022 at 6:51 AM [Executive Name] <send-via@mail-net-suites.com> wrote:


  [Recipient First Name],


  Could you please arrange ACH payment for this PWC LLP invoice today. See below and attached.


  ---------- Forwarded message ---------



  From: [Vendor Employee Name] <[Vendor Employee Username]@accounts-pwc.com>

  Sent: Thursday, May 12, 2022 10:14 AM

  To: [Executive Name]

  Cc: [Vendor Employee Name] <[Vendor Employee Username]@accounts-pwc.com>

  Subject: PWC LLP: INVOICE# 001691134 PAYMENT DUE


  A new invoice 001691134 has been generated and is attached for your review and payment.


  Please make payment via ACH (Automated clearing house). Bank information is on the invoice.


  If you are experiencing issues viewing the attached pdf via a mobile device, please use your standard mail client or webmail.


  Thank you,


  [Vendor Employee Name], CPA

  Chief Financial Officer

  PwC network.



  PricewaterhouseCoopers LLP

  411 Hamilton Boulevard

  Peoria, Illinois 61602

  United States

Attack Screenshots

No items found.

Malicious Artifacts

Additional Indicators of Compromise

Type

Description

No items found.

Attack Description

This text-based BEC attack impersonates a vendor/supplier using a fake email chain, a look-alike domain, and a payment inquiry theme to request a fraudulent payment.

Analysis Overview

Tactic
Fake Email Chain
Look-alike Domain
Goal
Payment Fraud
Impersonated Party
External Party - Vendor/Supplier
Vector
Text-based
Theme
Payment Inquiry
Language