{"success":true,"data":{"id":"vendor-invoice-approval-phish","label":"Fake BEC-style vendor invoice approval — CEO/CFO impersonation demanding urgent wire transfer via cold inbound email rather than through ERP portal (SAP/NetSuite/QuickBooks).","description":"Fake BEC-style vendor invoice approval email purportedly from a CEO, CFO, or executive demanding urgent wire transfer authorization for an outstanding vendor invoice. Real vendor invoice approvals go through ERP portals (SAP, NetSuite, QuickBooks) — they are NEVER initiated by cold inbound email with a wire transfer link. Classic accounts payable fraud targeting finance staff. Detection: vendor invoice/accounts payable/approve invoice vocabulary + wire transfer/EOD urgency + CEO/CFO/executive impersonation + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R19; FBI IC3 BEC advisory 2025; ACFE AP fraud report.","tier":"danger","category":"phishing","isThin":false}}