{"success":true,"data":{"id":"calendar-authority-bec-chain","label":"Post-meeting finance request BEC chain — email contains both calendar/meeting confirmation language and urgent wire transfer or payment instruction, suggesting a \"spoofed-CEO meeting-invite → follow-up wire request\" attack chain","description":"Detects the \"calendar invite → finance request\" BEC chain where attackers first send a meeting invite to establish authority, then follow up with a wire transfer or ACH payment request. The victim's acceptance of the invite (or reference to a prior meeting) is used to lower guard before the financial attack. Combined calendar-meeting language AND finance-urgency language in the same message is a strong BEC indicator even when the sender domain passes other checks. Does not fire when List-Unsubscribe is present (bulk mailers) or when email is a reply.","tier":"danger","category":"other","isThin":false}}