I have been a victim of a fraud where my solicitor's email address was used to dupe me out of a house purchase deposit. How do I determine where the emails originated from - did the crooks use emails from my inbox (hotmail) that somehow got re-forwarded back to me. Or did these email originate from my solicitor's server.
The emails that i now know are fake show
SPF fail - dkim=pass (signature was verified) header.d=clinicaser.info
In genuine emails, the dkim pass shows a different signature:
dkim=pass (signature was verified) header.d=mysolicitor
(i have removed the actual name for privacy reason).
If I can prove the breach wasn't my end this may help me recoup some of the money I have lost. I just have no idea how I go about this. The banks/Action Fraud have done nothing to help me. My solicitors have said it must have been my end but could not provide any evidence when asked how they know this.
I have used a message header analyser this just shows the emails came from my solicitors email address sent via a PHP mailer to my hotmail - SPF fail /DKIM pass and DMARC none
I have identified from the message source on both a fake & genuine email that the X-MS-Exchange-CrossTenant-Id is the same - however not sure what that proves, if anything.