Topic starter
27/06/2026 2:05 pm
TL;DR: Attackers now use lookalike domains, generative AI, and phishing-as-a-service to fabricate multi-party email threads for trust-based fraud, including RFQ scams and payment diversion schemes that can bypass legacy secure email gateways, according to Abnormal AI. The deeper issue is that relationship-based deception now scales faster than human verification workflows can reliably catch.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Inside the Multi-Party Scam: How Attackers Build Entire Conversations to Steal Your Trust”.
Key questions
Q: How should security teams stop multi-party email scams in business workflows?
A: Focus on the business process, not just the message.
Q: Why do lookalike domains and AI-written emails still fool staff?
A: Because people validate a request using context, not just syntax.
Q: What are the warning signs that a transaction thread is fake?
A: Watch for same-day domain registration, unfamiliar senders entering a known relationship late, unusual email applications, urgent payment pressure, and requests that expose missing process details.
Practitioner guidance
- Redesign payment verification around out-of-band confirmation Require a separate trusted channel to confirm banking changes, payment instructions, and release of funds before any transfer or fulfilment step.
- Baseline normal communication patterns for high-risk workflows Use behavioural signals such as sender history, domain age, reply structure, and conversation timing to flag transaction threads that do not match expected relationships.
- Lock down vendor and customer change requests Treat new payee details, new shipping contacts, and sudden quote changes as identity events that require stronger approval than ordinary email acknowledgement.
Bottom line: Multi-party email scams exploit transaction trust, not just email content, so inbox filtering alone cannot stop them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
27/06/2026 3:41 pm
Multi-party email fraud is now a relationship-governance problem, not just a message-security problem. The attack surface is the business conversation itself, where trust is accumulated across replies, copied participants, and expected process steps. That means the control failure sits above the inbox and inside the workflow. Practitioners should stop treating email as the unit of defence and start treating the transaction context as the control boundary.
A question worth separating out:
Q: What should organisations do when a fraudulent payment request reaches finance or sales?
A: Escalate through a separate validation path before any money moves or goods ship. Confirm the requester through a trusted number or internal directory, compare the domain and account history with known records, and pause the workflow until the approval owner has reviewed the anomaly. That containment step matters more than trying to judge intent from the email alone.
👉 Read our full editorial: Multi-party email scams expose the limits of email security
This post was modified 4 days ago by NHI Mgmt Group