DKIM and DMARC Passed. The $97,500 Wire Was Fraud.

**Executive summary:** A business-email-compromise attack used a legitimately signed email (DKIM/DMARC pass via the organization's SendGrid stream) to deliver a fraudulent invoice demanding a same-day $97,500 wire; the fraud hinged on a mismatched Reply-To ([email protected]), a SendGrid tracking pixel for live-target confirmation, forged metadata to appear internal, and an urgent discount to coerce payment.