31–40 of 88 posts
They send a fake-looking email to themselves (using existing invoices as a template), then feign ignorance and refuse to pay for goods/services because "we sent the money, not our fault you didn't get it".
Even better that they'd send a few emails saying "we're working on paying you, don't bug us about it" -- payments are harder to collect as time passes for a number of reasons (in my experience).
Your email did not get hacked most likely. Your client got tricked. They spoofed an email with your domain, but the reply-to email was their own (the attacker). So the client thinks they responded to you, but they responded to the fake address. Also, generally when they do this, they spoof the body and the conversation of the email. Most likely, your client's emails were compromised in this case. Ask them to forward…
Email headers of the fake email I received are below. Can anyone identify anything out it? ------- Received: (qmail 30963 invoked by uid 30297); 16 Oct 2018 19:04:18 -0000 Received: from unknown (HELO sg2plibsmtp01-1.prod.sin2.secureserver.net) ([182.50.144.11]) (envelope-sender ) by sg2plsmtp19-01-25.prod.sin2.secureserver.net (qmail-1.03) with SMTP for ; 16 Oct 2018 19:04:18 -0000 Received: from se1-lax1.servconfig…
User-Agent: Roundcube Webmail/1.3.31. Get/Hire someone to do a proper analysis of the "breach". This may require your client's cooperation.
2. Regardless of whose fault that was, try to improve the process to protect yourself and your clients in the future (e.g. email signing, confirmation via a different channel, different way of collecting payments etc.)
This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept pa…
Is there anyway to recover that money?
Then again, it might be transferred again as well. Money is hard to trace if it moves through different jurisdictions, as every country has different banking and privacy laws. Your client might very well hit a dead end for such a (in the grand scheme of things) small amount of money.
Earlier quoted context omitted.
Can we find out something from it?
I think rnotaro solved the whole mystery: https://news.ycombinator.com/item?id=18310631
Immediately contact all the banks involved and report the fraud. They should be able to reverse the transaction.
I'm surprised I'm the first person to point this out, but you have not lost any money, your client has. You sent the goods to the client, and they have yet to remit the payment to you. So they still owe you the money and you should insist they pay it. Granted, they're not going to like that, but the reality is they sent payment due to you to some other person. That's something they did not something you did. They may…
Emails sent from your domain usually constitute valid contracts. If you're letting other people send emails from your domain because you don't have SPF configured then there's a good chance a court would either rule that you've allowed them to enter into a legally binding contract on your behalf, or else that you were negligent and owe the $10,000 back in damages.
That's why you need to take away the email addresses of people who no longer work for your company, so that they can't enter into contracts on your behalf.
That said no one should ever wire money based on anything they receive via email. So if the sender email had SPF but the recipient just didn't see it flagged because it was in SOFTFAIL mode or whatever, then it's probably the client's fault at that point.