The W-9 Was Real. That Was the Point.

A targeted invoice-fraud/business-email-compromise campaign used a fabricated invoice plus an authentic IRS Form W-9 (genuine tax number and address) to impersonate a household-name vendor and request payment; the phishing message carried lookalike domains, throwaway reply infrastructure, and attachments that scanned clean, exposing verification weaknesses rather than malware. The message was quarantined then released to an accounts-payable mailbox, reported and marked malicious with no funds moved; the report recommends out-of-band vendor callbacks and controls to verify payees rather than relying solely on document artifacts.