Email headers can reveal originating IPs, SPF/DKIM results and reply-to mismatches that body text hides. They are essential in BEC and invoice-redirection files.
Save the full raw message, not a forwarded snippet that strips headers. Most mail clients offer a “view original” or “show source” option.
Compare the display name to the actual from-address and any lookalike domain. Small character substitutions are easy to miss without side-by-side review.
Provide headers to counsel and, where appropriate, to bank fraud teams with the payment that followed. Technical context makes the deception easier to explain quickly.
Disclaimer: This article provides general information only. It is not legal advice and does not guarantee recovery in any matter.