The Teams Invite Whose Meeting ID Disagreed With Itself

**Executive summary:** A short, high-risk phishing message was delivered from a compromised legitimate Microsoft 365 mailbox to a CFO; it presented a "Listen to recording" link hosted on an attacker-controlled .es domain and a Microsoft Teams meeting block whose printed Meeting ID did not match the join URL, indicating manipulation and a likely business email compromise (BEC) attempt despite all authentication checks passing.