Legacy email security systems are excellent at stopping known threats. If a malicious link has been flagged before, or if a sending domain is on a global blacklist, the email gets blocked. But what happens when an attacker uses generative AI to instantly script dozens of highly convincing lookalike domains, pairs them with short-lived disposable domain infrastructure, crafts a hyper realistic fake invoice, and reaches out to your finance department for the very first time?
With generative AI automating mass registration and drafting flawless corporate copy, threat actors can now spin up and cycle through disposable domains on an industrial scale. Because these malicious variations are spun up in minutes and discarded within days or even hours, static blacklists and reputation databases can never update fast enough to catch them.
Historically, these malicious initial contact emails would often slip through your security system, potentially exposing employees to Business Email Compromise (BEC). A single financial scam can lead to direct financial loss, operational disruption, and reputational damage, with such BEC scams costing U.S. organizations over $3 billion in reported losses in 2025 alone.
To address this “blind spot”, we developed a Financial Scam Detector (FSD); a model that detects sophisticated first-time financial scams by shifting the focus from "is this domain known to be bad?" to "is this interaction suspiciously unfamiliar?"
The Problem: Why Initial Contact Scams Evade Traditional Security
Modern financial phishing has evolved beyond poorly written emails. Today, attackers frequently deploy advanced invoice campaigns, going so far as to include fabricated reply chains within the email body to make it look as though the message is a continuation of a legitimate, ongoing thread.
To a legacy email filter, the message looks clean. The AI generated domain isn't blacklisted yet, the language appears professional, and the visual layout mimics a trusted partner. Because legacy security tools lack the context of relationship history, they treat this dangerous first-time outreach just like any other routine email.
The Solution: Combining Three Types of Signals
The FSD model addresses this vulnerability by combining three types of signals:
User Profiling Infrastructure (UPI): Analyzes historical relationship data to verify if an inbound email is a first interaction between sender and recipient at individual and domain levels.
Subject-Line Model: Uses Natural Language Processing (NLP) techniques to scan subject lines for financial intent (e.g., wire transfers, ACH updates, invoices).
Domain Reputation Features: Guards against disrupting legitimate communications by checking reputation and digital maturity via key behavioral features:
Domain age: Legitimate vendors operate on established infrastructure for months or years; scammers spin up fresh domains days or hours before an attack.
Sending volume and consistency: Established businesses show predictable patterns; fraudulent domains often have no footprint followed by a sudden, isolated burst targeting financial endpoints.
By shifting the perspective to relationship forensics, the model uncovers a fundamental truth about these attacks: no matter how realistic the fake reply chain appears or how professional the AI generated domain seems, the sender’s actual email address and domain are entirely new to the recipient. When an email pairs first-time contact with financial subject matter and weak domain reputation, the model flags it as a high-risk threat automatically.
Real World Case Study: Anatomy of a "Domain Hopping" Campaign
Production data clearly exposes the primary tactic of modern scammers: infrastructure cycling. Instead of sending thousands of emails from a single domain, attackers leverage AI automation to rapidly hop across multiple freshly registered lookalike domains.
When analyzing live data, the FSD model successfully caught two highly sophisticated, multi-domain operations that legacy signature filters missed:
Case Study 1: The IRS Tax Fraud Campaign
In Figure 2, this campaign targets individuals by exploiting urgent financial anxieties surrounding tax returns. The attacker subtly alters the linguistic framing of the subject line while aggressively rotating through distinct, newly registered, .help top level domains:
Subject Line Variations: Alternated between "You could be owed money by the IRS" and "You may be owed money by the IRS."
Infrastructure Cycling: Sent using identical naming patterns across three separate domains:
Case Study 2: The "WardJ" Banking Campaign
In Figure 3, this actor launched a targeted B2B corporate banking scam. The attack spoofed a single executive persona ("WardJ") to send high stakes financial proposals while dynamically switching domains and subdomains across .site and .online architectures to evade detection:
Subject Line Variations: Tailored to mimic standard commercial banking discussions, including "Business banker – core deposit growth – active producer", "Commercial banker – middle market – self-sourced pipeline", and "Commercial RM – $80M book – heavy BD – open."
Infrastructure Cycling: Spanned five distinct endpoint combinations from the exact same sender persona:
In an enterprise environment, none of these domains possessed an active historical communication footprint within the UPI. Because there was no record of prior conversation, the combination of high-risk financial keywords and automated domain hopping was correctly detected by the FSD model, blocking these messages from reaching employee inboxes.
Model Performance
We have observed that once deployed, the FSD model generated thousands of new detections per week with approximately a 99% True Positive (TP) detection rate. The messages flagged by the FSD were typically suspicious in nature but could not be enforced without the additional confirmation provided by the model.
