Business email compromise

The iPhone she never owned: an account takeover, read backwards

A business email compromise where the decisive evidence wasn't the foreign sign-in or the inbox rule — it was an MFA device the user swore she never enrolled.