gift-card scam email reached executives; keyword filter failed to match misspellings

TL;DR

Attackers misspell the trigger words precisely because they know tenants filter on them, writing gift crads or spacing letters to break string matches. Chasing spellings is a losing game. Detect the pattern instead: an urgent, secretive purchase request from an executive persona to a staff member, from an external source. Combine impersonation protection for executives with anomaly signals and a rule on the request structure, not the product words.

gift-card scam email reached executives; keyword filter failed to match misspellings

Use this when

• A gift-card scam reached staff or executives with misspelled keywords that evaded the filter.
• Similar scams recur with rotating misspellings and domains.

Not for this skill when

• The request came through the official recognition platform. That is legitimate process, not a scam miss.
• The scam arrives by text or personal mail. Mail filtering cannot govern it; handle through guidance.

Steps

1. Collect several scam samples and list what they share beyond keywords: sender pattern, urgency framing, secrecy instruction and target roles. Verify: the stable pattern elements are documented.
2. Confirm executives are in impersonation protection and that first-contact and external tips show for these messages. Verify: persona protections are active for the impersonated names.
3. Replace brittle keyword conditions with layered conditions: external origin plus executive display name plus purchase or secrecy phrasing variants scored together. Verify: the rule no longer depends on one correct spelling.
4. Set the action to banner and hold for review for messages matching the full pattern, rather than silent delivery or hard block. Verify: matched mail is visibly flagged.
5. Test with a controlled message using a fresh misspelling. Verify: the pattern rule flags it despite the novel spelling.

Variant phrasings

gift card scam misspelling keyword filter evasion

The evasion variant.

executive impersonation gift card request pattern rule

The pattern rule variant.

Compatibility: Defender impersonation protection and Exchange mail flow rules with weighted conditions.

Why it happens

Keyword lists assume attackers cooperate with your vocabulary. Obfuscation is free for them and expensive for list maintainers, so durable detection has to price in the social structure of the scam, which cannot be misspelled away.

Edge cases / pitfalls

• Fuzzy matching helps at the margins but generates false positives on real finance vocabulary. Use it as one signal, not the rule.
• The strongest organisational control is cultural: executives publicly never asking for gift cards by email, stated once and repeated.
• Targets are often new joiners. Add the pattern to onboarding security guidance.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstlc8XO4yjb6pquL7jJPjPw