Lookalike Domain Fraud
Lookalike Domain Fraud: The £932,000 Red Kite Case
< BLOG
Lookalike Domain Fraud: The £932,000 Red Kite Case
In 2019, Red Kite Community Housing lost more than £932,000 after falling victim to lookalike domain fraud. The case matters because Red Kite was not an organisation with no cyber defences. It had established processes, security testing and a two-stage process for verifying payment and account changes. Yet attackers still found a way through.
Their method was simple in principle: impersonate a trusted supplier, use a similar domain and email address, and make a payment-change request appear genuine.
What happened?
The attackers mimicked the domain and email details of contacts known to Red Kite. They then recreated an email thread that appeared to be a legitimate continuation of an existing supplier conversation.
This is a classic business email compromise attack. Rather than breaking into Red Kite’s systems, the criminals relied on deception. Their aim was to convince staff that a supplier had changed its bank details.
The payment was then sent to the criminals, resulting in a loss of more than £932,000. Red Kite later confirmed that its IT systems had not been compromised. The fraud succeeded because the attackers exploited trust in a familiar supplier relationship and a failure to complete the organisation’s existing verification process.
Why lookalike domains work
Lookalike domain fraud works because people read email addresses quickly, especially when a message fits an existing conversation. An attacker may register a domain that differs from the genuine supplier’s domain by only one character, a hyphen, a different extension or a visually similar letter. For example, a genuine address such as:
- accounts@supplier.co.uk
Could be imitated with something like:
- accounts@suppl1er.co.uk
At a glance, the difference can be missed. If the email also uses familiar names, language, project details and a believable request, it can bypass normal suspicion. In the Red Kite case, the lookalike domain helped the criminals create a convincing impersonation of known service providers. It was not the only control failure, but it was a key part of the fraud infrastructure.
Could early domain monitoring help?
A service that monitors for suspicious registrations can provide an early warning when a domain resembling a supplier, partner or organisation is registered.
If Red Kite had been alerted to a newly registered lookalike supplier domain before the payment request was processed, it could have prompted investigation. The finance team could have been warned not to accept bank-detail changes from that domain and asked to contact the supplier through an established telephone number or contact record.
Domain monitoring does not replace payment controls. It gives an organisation an additional signal: a potentially deceptive domain exists and could be used for impersonation. That warning is particularly valuable for businesses that regularly pay suppliers, contractors, agencies or professional advisers.
The controls that stop the payment
The core lesson is that every bank-detail change should be treated as high risk, even if it arrives in an existing email thread.
Useful controls include:
- Verify bank-detail changes by calling a trusted contact using a number already held on file
- Never use contact details supplied in the change request itself
- Require two people to approve changes and confirm that both checks were completed
- Flag domains that are similar to known supplier domains
- Train finance and procurement teams to check the full sender address, not only the display name
- Maintain a process for reporting suspicious domains and emails quickly
Red Kite’s experience shows why lookalike domain fraud is not simply an IT issue. It is a business-risk issue involving supplier management, finance processes and staff decision-making.
The practical takeaway
The criminals did not need to breach Red Kite’s network. They used a convincing lookalike domain, a familiar-looking email conversation and a missed verification step to redirect a substantial payment.
For SMEs, the practical response is straightforward: monitor for impersonation domains, make payment-change verification non-negotiable and ensure staff know that an email thread is never proof that a request is genuine.
A lookalike domain alert will not stop every fraud attempt. But it can give your business the warning needed to ask the question that prevents a costly payment: have we independently verified who is really asking?
