FRAUD WITH A BADGE: HOW“ REAL” PLATFORMS POWER REAL SCAMS by Paul Smart, Nex-Tech
You know how some words get thrown around so much that they start to lose all meaning and become background noise? That’ s how“ cybersecurity” has felt for a while to a lot of people. We’ ve started to become numb to it because attacks are so frequent and the media talks about it nonstop— but it’ s just as real as it’ s ever been, and the bad guys keep leveling up.
With the evolution of AI, Business Email Compromise( BEC) attacks have become more sophisticated— and harder to spot. Think“ professional con artist,” not“ Nigerian prince with a typo budget.” Here’ s a real example:
In late 2024, Mimecast researchers documented a targeted BEC campaign. They found that the attackers didn’ t spoof DocuSign— they used the real DocuSign platform. In other words, the scam wasn’ t wearing a fake mustache; it walked in with a badge and a clipboard. How, you ask?
They created real DocuSign and Adobe Sign envelopes using legitimate accounts. That meant the messages came from trusted DocuSign infrastructure, so they weren’ t flagged by security
tools— because, technically, it really was DocuSign. Then they impersonated a real law firm that the victim organization already worked with and followed up with fraudulent invoices and payment requests.
The initial email looked exactly like a normal DocuSign“ please sign” request— correct branding, correct workflow language, and correct sender infrastructure. Once the victims were engaged, they were asked to call a phone number where someone impersonated the law firm. After that, subsequent emails came from a look-alike domain and included fraudulent invoices.
Now, I’ m a pretty smart guy( pun intended by my name), but I’ d be hard-pressed to catch something like this unless there were strong protocols we were actually required to follow. In this case, the only way I can see it being caught is to call the law firm using a verified number( for example, one you already have on file, or one you look up independently) and confirm they sent the request. Yes, it’ s inconvenient. So is fraud. Remember: these emails weren’ t the usual“ kindly do the needful” scams.
26 KANSAS INSURANCE AGENT & BROKER