BEC Financial Theft - New Sender Domain with Financial Keywords and Banking Access

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•4

This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.