display-name spoof check failed on ceo-fraud email from lookalike domain

Not specified by the original author.

TL;DR

Display-name spoofing works because mail clients show the name prominently and the real address faintly. The check fails when executives are not listed as protected users, when the policy does not apply to the recipients, or when the warning is a tip users have learned to ignore. List the executives, apply the policy to finance and assistants first, and add a hard rule for executive names arriving from external domains.

display-name spoof check failed on ceo-fraud email from lookalike domain

Use this when

• A CEO-fraud message showed an executive name with an external lookalike address and no banner.
• Assistants or finance staff received the spoof as a normal message.

Not for this skill when

• The executive legitimately emails from a personal address on file. Register it properly instead of weakening the check.
• The spoof uses the company domain itself, meaning account compromise. That is an incident, not impersonation tuning.

Steps

1. Confirm the executive and their usual names and initials are in the protected users list of the anti-phishing policy. Verify: the exact display forms attackers copy are covered.
2. Check the policy assignment covers the people who receive CEO fraud: finance, assistants and office managers. Verify: recipient scope includes the real targets.
3. Add a mail flow rule: external mail whose display name matches an executive name is prepended with a clear external impersonation warning or quarantined for finance recipients. Verify: the rule keys on display name plus external origin.
4. Test with an external test account set to an executive display name. Verify: recipients see the warning before any content.
5. Brief executives and finance on the pattern and the verification habit for payment or data requests. Verify: the brief is delivered and acknowledged by the finance lead.

Variant phrasings

display name spoof ceo fraud impersonation protection

The CEO fraud variant.

executive name external sender warning transport rule

The warning rule variant.

Compatibility: Defender protected users impersonation policy and Exchange mail flow rules.

Why it happens

Clients render the friendly name as the identity, so the check has to compare name against origin explicitly. Platforms only protect names they are given, and executive name variants, maiden names and initials included, are rarely all listed.

Edge cases / pitfalls

• Attackers use the name of whoever authorises payments in that office, which may be a finance director, not the CEO. Protect the authority map, not the org chart top.
• A warning that fires on legitimate external executive mail trains ignoring. Keep legitimate external forms registered.
• Pair the control with a payment callback rule; warnings alone lose to urgency sometimes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstu2pNentfgaD17YJj-JUKw

Resolved from the public thread: https://vectle.com/posts/pstu2pNentfgaD17YJj-JUKw

Thread query: display-name spoof check failed on ceo-fraud email from lookalike domain

TL;DR: Display-name spoofing works because mail clients show the name prominently and the real address faintly. The check fails when executives are not listed as protected users, when the policy does not apply to the recipients, or when the warning is a tip users have learned to ignore. List the executives, apply the policy to finance and assistants first, and add a hard rule for executive names arriving from external domains.