An email appears to come from a colleague, but one letter in the domain is different. A separate exposure record mentions the colleague's real address. It is tempting to connect the two immediately.
They may be related. They may also be independent observations that require different responses.
Name each signal precisely
A lookalike domain is an address chosen to resemble another. A spoofed message claims a sender identity that may not match its actual origin. An exposed account record is evidence about an identifier and associated service context.
The FBI's business-email-compromise guidance includes impersonation and slightly altered addresses among the patterns organizations should examine. It does not make every suspicious message proof of access to the genuine mailbox.
Preserve the original message through the approved reporting process rather than forwarding a screenshot that loses useful context.
Match the owner to the question
The messaging team can examine message routing and authentication evidence. The identity team can review the genuine account's access. The brand or domain owner can assess the impersonating address and appropriate escalation.
A hypothetical supplier request from example-payments.com is not made authentic by separately finding an employee of example.com in historical exposure evidence.
Likewise, an absence of exposed credentials does not validate the payment request. Financial authorization still needs its own established verification route.
Avoid chasing the wrong account
If the message came from a lookalike domain, changing the real employee's password does not remove the impersonating address. A password action may be justified by independent account evidence, but it should have an explicit reason.
If the genuine account shows unauthorized access, the response also needs to address sessions, recovery, and relevant activity—not just the visible message.
Do not contact the sender using a telephone number newly supplied in the disputed message. Use an already established business contact path.
Report the relationship as a hypothesis
A useful incident note can say that two observations are being assessed together while preserving their separate evidence. Record the time, service, account, and reason for any containment decision.
Afterward, review who receives suspicious-message reports and how the finance team verifies changed instructions. Training should teach the business control, not merely encourage people to scrutinize every character while under time pressure.
For the related account investigation, read finance-account exposure response and prioritizing privileged work identities. Accurate distinctions help each team act on the signal it actually received.