Scam of the Week
One email scam pattern each week — the fake email, the tells that give it away, and how to spot it before anyone pays. Every example below is fictional (fake companies, fake domains), but the pattern is exactly what lands in real inboxes every day.
A picture is worth a thousand words — this is what it looks like when the dog catches one, right in your Outlook: the ⛔ Likely Scam band, and every red flag spelled out in plain English.
Week of September 8, 2026 — the "updated wiring instructions" email
This is the one that empties escrow accounts. It arrives mid-transaction — a closing, a big invoice, a vendor payment — when money is already expected to move. It looks like this:
Reply-To: meredith.cole.escrow@fastmail-secure-docs.com
Subject: URGENT — Updated wiring instructions for Friday's closing
Hi — our bank flagged an issue with the account we sent earlier, so please use the updated wire details attached for Friday's closing. Kindly confirm once sent — the funds must land before 2 PM tomorrow or the closing date is at risk.
Thanks for your quick help,
Meredith
The three tells:
1 · The reply goes somewhere else. The From address looks like the escrow company — but the Reply-To quietly routes your answer to a free mailbox on a domain you've never seen. Real companies reply from where they send.
2 · "Updated" payment details. Banking details changing mid-transaction is the single highest-risk sentence in email. Real escrow officers know wire fraud is epidemic — they don't change instructions by email, and they expect you to call and verify on a number you already have.
3 · A clock. "Before 2 PM tomorrow." Urgency is the tool that stops you from doing the one thing that defeats this scam: slowing down and verifying. Deadline pressure plus money movement is the pattern, every time.
What to do: never wire to details received by email without verifying by phone — on a number from your existing records, not from the email. And forward the message to your IT contact; if one person in a transaction got it, others did too.
Names, companies, and domains above are invented. The pattern is real — business email compromise is a multi-billion-dollar-a-year crime, and the "changed wiring instructions" variant hits real-estate closings, escrow, and accounts-payable teams hardest.
OutlookDog reads these tells the moment you open the message — the mismatched reply-to, the payment-detail change, the deadline pressure — and puts the warning where you can't miss it, before anyone acts. (AI can make mistakes; a flag is a heads-up to verify, and you decide.)
New pattern most weeks. Spotted a clever one in the wild? Strip anything private and send it to support@outlookdog.com — the dog is always collecting scents.