Lookalike domain

If Example Carrier LLC uses examplecarrier.com, a fraudster might register examplecarriers.com, example-carrier.com or examp1ecarrier.com (with the number 1). On a phone screen, which often hides the full address, the difference is easy to miss. Lookalike domains are a standard tool in business email compromise and broker impersonation attempts that don't involve a hijacked mailbox.

For a factor, they appear in bank-change requests, fake NOAs and release letters, and debtor contacts on rate cons. IC3's guidance on BEC is to check that URLs and sender addresses really match the organization, watch for misspelled domains, and set email clients to show full addresses.

Keep each client's and debtor's real domain on file, compare every payment-related email against it, and verify by phone at a known number. The remit-to change checklist builds this in.