Device Intelligence and Email Signal Reveal Spoofing
The sender domain lacks proper SPF/DKIM records, and our Device Intelligence flags the login session as coming from a high-risk IP. The email is marked suspicious due to past phishing activity tied to similar domains.
Unit21 Rules Catch Payment Behavior Anomaly
A Unit21 rule triggers when a first-time wire to a new beneficiary is requested outside normal hours and without a prior invoice. This unusual combo of risk signals escalates the event.
Pattern Detection Matches BEC Typology
Using historical behavior models, Unit21 maps the request to a known BEC pattern: sudden urgency, new account info, no voice confirmation, and email anomalies. This matches typologies seen in prior wire fraud cases.
Escalation and Wire Transfer Block
The customer’s risk score is elevated, and the wire is paused. Unit21 alerts internal fraud and finance teams to review before release - preventing the loss of $85,000.
AI Agent Prepares Regulatory Filing
The AI Agent pre-drafts a SAR citing impersonation, spoofed communication, and attempted unauthorized funds transfer. Documentation is saved, and compliance submits the filing within hours.