The LinkedIn Invoice That Passed Every Email Check

**Executive summary:** A high-risk Business Email Compromise campaign used a lookalike domain (linkedinreceivables-mail.com) registered days earlier and properly configured with SPF/DKIM/DMARC to pass email authentication; a minimalist one-line invoice query was sent to accounts-payable to initiate payment diversion, backed by attacker-controlled tracking subdomains and a UK-based relay IP, demonstrating that authentication alone does not prove sender legitimacy and recommending behavioral detection, monitoring of newly registered domains, and AP training.