The Email Looked Fine. The Domain Was Two Weeks Old.
A polite, specific email asked us to quote laptops for a school district. Nothing in the message was wrong. The domain behind it was 15 days old.
Written by Shimon Goldner
We got an email recently from a school district. They were planning their laptop purchases for the rest of the year and wanted pricing.
Nothing about it looked wrong. It was polite. It was specific. It named a real school district that really exists, in a real town, with real students. If you got this email, you would answer it.
We looked the domain up first. It was registered 15 days ago.
The real district has had its domain for years. This one was two weeks old, running on a free email service. Someone registered a name that looks like the school's, set up a mailbox, and started asking companies for quotes.
How this scam works
The company sends a quote. The "district" sends back a purchase order and asks for the equipment on 30-day terms, the way schools and towns normally buy. The equipment ships. Nobody pays. The domain disappears.
It works because nobody argues with a school district. The name does the convincing, and the request is exactly what a school would really send when it is planning for the year ahead.
It is the same idea as the business email compromise we wrote about, where nothing in the message looked broken either.
What actually caught it
Two lookups, about a minute of work.
The domain age. A real organization's domain is old. Anything registered in the last few months, claiming to be an established institution, is a problem. You can check when a domain was registered for free.
The mail setup. The real district uses the email system you would expect an established organization to use. This one was on a free service, set up days earlier.
Neither check requires being technical. They just require looking before you reply.
What to do with an email like this
None of this is advanced security work. It is a habit.
- Check the domain against the real one, character by character. Lookalikes swap or add letters and hope you skim past it.
- Look up the organization yourself and call the number from their own website. Never call a number in the email. If the person is real, they will confirm it in thirty seconds.
- Be careful with terms. If a new customer wants goods shipped before paying, that is when the risk is real.
- Watch the shipping address. Fraud almost always ships somewhere other than the organization's actual address.
Everything most people are told to look for was absent.
The part worth remembering
This email had no spelling mistakes, no strange links, and no pressure to hurry.
The tell was not in the message. It was in the domain behind it, and you only see that if you look. Email is never just email.