Fake CC
Fraudsters will sometimes cobble together a convincing email string by cc’ing other parties — a fake approver, manager, etc. — using real names they’ve gathered, along with spoofed email addresses. They may even mention that they’ve copied someone to try to demonstrate authenticity.
“Inspect email addresses of cc’d parties just as carefully as the sender’s email,” Anastasakis said.