Lookalike Domains and Typosquatting: Phishing, Invoice Fraud, and the Legal Tools That Take Them Down

Suppose a domain called northgate-alloys.com goes live at 2:00 on a Tuesday morning. The real supplier, a hypothetical metals distributor, has used northgatealloys.com for fifteen years. The one hyphen cost the person who added it about the price of a sandwich. At 9:40, an accounts payable clerk at a fittings manufacturer gets an email in a thread she recognizes, about an invoice she recognizes, from a sales manager whose name and signature block she has seen for years. Northgate has changed banks, the email says, because of an audit. The new remittance details are attached. By lunch she has released $380,000, and she followed every step of the procedure she was trained on.

Nothing about that story is exotic. In Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union, 133 F.4th 264 (4th Cir. 2025), a metal fabricator paid $558,868.71 after receiving emails from Olysteel.net when its steel supplier's real domain was Olysteel.com. In Apache Corp. v. Great American Insurance Co., 662 F. App'x 252 (5th Cir. 2016), an oil company sent about $7 million after fraudsters registered petrofacltd.com to imitate a vendor. In Thomas v. Corbyn Restaurant Development Corp., No. D083655 (Cal. Ct. App. May 27, 2025), a stray letter "r" turned cnlegalgroup.com into cnlegalrgroup.com and tysonmendes.com into tysonmenrdes.com, and $475,000 in settlement money went to someone who was neither law firm.

The law has plenty to say about this. The trouble is that it speaks from four separate rooms: ICANN contracts, trademark dispute procedures, federal court, and the commercial law of payments and insurance. The tools in those rooms run on different clocks, and the fastest ones are the least known. This article walks through all four.

The short answer

• A lookalike domain is cheap, legal to buy, and usually live before anyone notices. The fraud happens in email more often than on a website, so the domain may never host a page at all.
• Your own DMARC record does not stop it. SPF, DKIM, and DMARC protect your exact domain from forgery. A fraudster who owns a different domain can authenticate that domain perfectly, and the message will pass every check.
• The fastest tools are not courts. A well-built abuse report to the registrar, the host, the CDN, and the browser blocklists can disrupt a phishing domain in hours or days. Since 5 April 2024, ICANN's contracts have required registrars with actionable evidence of phishing to act promptly.
• The trademark procedures are slower but more durable. The URS can lock a name within 24 hours after the registry receives the provider's notice, but it covers only some top-level domains, not .com, and ends in suspension. The UDRP usually takes about two months and can transfer the name.
• Federal court is for the hard cases. The Anticybersquatting Consumer Protection Act (ACPA) offers transfer and statutory damages of $1,000 to $100,000 per domain. An in rem action reaches an anonymous registrant. An emergency order under Rule 65 can bind intermediaries that knowingly help. The ACPA routes require protectable trademark rights, while an emergency order can also rest on computer-crime claims where there was a real intrusion. A money judgment against a phantom defendant may be worth little either way.
• The money and the domain are separate problems. Taking down the domain does not bring a wire back. The first call goes to the sending bank, the second to the FBI's Internet Crime Complaint Center, and those calls belong in the first hour.
• The bank usually keeps its money. Under UCC § 4A-207 and Studco, a beneficiary's bank may rely on the account number unless it actually knows the name and number do not match.
• Between the two trading partners, the loss tends to follow the missed red flag. Courts have converged on asking which party was in the best position to prevent the fraud, and the party that paid without checking through an independent channel often loses.
• Insurance depends on the words of the policy. Crime-policy cases split on whether an emailed lie is a direct loss from computer fraud. Dedicated fraudulent-instruction or social engineering coverage is the cleaner route, often with a sublimit and verification conditions.

How lookalike domains actually work

Lawyers tend to treat a domain name as a piece of text. For this problem it helps to treat it as a set of database records, because each record is a place to intervene.

The chain of custody for a name

A registry runs a top-level domain and keeps its authoritative database. Verisign runs .com and .net. A registrar sells registrations and submits changes to the registry. A registrant holds the name, often behind a privacy or proxy service, and registrant data is now usually redacted from public lookups. For the basic architecture, see Top-Level Domain Names: An Overview.

Once registered, the name needs name servers, which answer questions about the domain. The answers come from DNS records. An A record gives the IP address of a website. An MX record names the mail server that accepts mail for the domain. A TXT record holds text, including the email authentication policies discussed below. To run an invoice fraud, the fraudster needs only a mail account at the lookalike domain, which any commercial email provider will sell for a modest monthly price. A website is optional. That is why "there's nothing at that address" is a misleading finding. Run an MX lookup before you conclude a domain is dormant.

A browser or mail server finds all this through a chain of lookups. It asks the root, then the registry's servers, then the name servers the registrant chose. Pull any link and the name stops working. That simple fact organizes the remedies. The registrar or registry can change the name servers or place a hold, which kills the domain everywhere. The host can take down the content but leaves the mail running on another provider. The CDN can stop proxying, and the mail provider can close the mailbox. Each is a different pressure point with a different owner.

The taxonomy of imitation

The vocabulary below appears in abuse reports and panel decisions, and the differences have practical consequences.

Typosquatting is the umbrella term for names that bet on a misspelling. Combosquatting attaches the real brand to another word. Researchers studying it at scale found it more prevalent than classic typosquatting (Panagiotis Kintis et al., Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse, ACM CCS 2017), and it matters legally because the brand appears intact inside the name, which makes confusing similarity easier to show.

Homoglyph attacks rely on internationalized domain names. The DNS was built for a narrow set of ASCII characters, so a name containing other scripts is converted into an ASCII form called Punycode (RFC 3492), which begins with xn--. The Cyrillic letter that looks like a Latin "a" is a different character with a different code point. Security researcher Xudong Zheng showed in 2017 that a name composed entirely of Cyrillic look-alikes could render in some browsers as if it were apple.com. Browsers have since adopted display rules that fall back to the xn-- form in many suspicious cases, but those rules vary by product, and an email client's display name does not protect anyone. When you document one of these, record both the Unicode and the xn-- form, because registrars and registries key on the second.

Microsoft put this technique in front of a federal judge. Its 2021 action in the Eastern District of Virginia (Microsoft Corp. v. Does, No. 1:21-cv-822) described a group that used stolen credentials to study customer accounts and then impersonated those customers from nearly identical domains, swapping a zero for an "o" and a lowercase "l" for a capital "I." The company reported obtaining a temporary restraining order in July 2021 directing registrars to disable the names. Its complaint is worth reading for a reason that follows below: it pleaded computer-crime and common-law claims, with no trademark count.

Subdomain deception deserves a special note. In quillfreight.com.secure-remit.net, the registrable domain is secure-remit.net, and quillfreight.com is just a label the owner made up. A complaint that names the wrong domain goes to the wrong registrar and wastes the day. It also does not fit the trademark tests neatly, since the part of the string that was registered may contain nothing of your mark.

Why email authentication doesn't save you

Three standards protect email. SPF (RFC 7208) lets a domain publish which servers may send its mail. DKIM (RFC 6376) has the sending system sign the message with a key published in DNS. DMARC (RFC 7489, replaced in May 2026 by RFC 9989) ties those two checks to the domain in the visible From line and tells receivers what to do with failures.

All three answer the same question, which is whether this message really came from the domain it names. A message from jsmith@northgate-alloys.com really did come from northgate-alloys.com. The fraudster set up SPF, DKIM, and DMARC on that domain, often with a few clicks at the mail provider, and the message passes. A green authentication result only says the sender controls that domain. It says nothing about whether that domain is the company you think it is.

DMARC still matters. It closes off true spoofing, in which a forger puts your real domain in the From line. That was the problem in Medidata Solutions Inc. v. Federal Insurance Co., 729 F. App'x 117 (2d Cir. 2018). As fraudsters lose that route, they shift to lookalikes, and courts sometimes use "spoofed" loosely for both. The distinction can matter for insurance, as discussed below. Nor does a padlock in the browser mean anything here. Certificate authorities issue free certificates on proof that the applicant controls the domain, so the padlock confirms only an encrypted connection to the fraudster.

Certificate issuance does help defenders in one way. Public Certificate Transparency logs record most newly issued certificates, so a monitoring service can often see a name containing your brand soon after it gets a certificate, sometimes before the first fraudulent email goes out.

The anatomy of an invoice fraud

The FBI's Internet Crime Complaint Center (IC3) defines business email compromise (BEC) as a scam aimed at businesses and individuals who regularly make wire payments, carried out by compromising email and other communications through social engineering or computer intrusion. Its 2025 annual report lists $3,046,598,558 in reported BEC losses for that year.

The lookalike domain typically appears at stage three of a four-stage operation.

1. Access. A credential-phishing page or an infostealer yields a password to a mailbox at one of the two companies. In Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 F. App'x 348 (6th Cir. 2018), the intruder was in a sales manager's account for weeks.
2. Reconnaissance and concealment. The intruder reads invoices and learns who pays whom, then adds mailbox rules. In Beau Townsend, rules diverted messages from the buyer into the deleted items folder and forwarded them to a Gmail account the hacker had created.
3. The switch. Now a lookalike domain takes over the conversation, or a look-alike address gets copied into it. The target keeps replying to what appears to be the same thread, and the real counterparty drops out without either side noticing. In Thomas, the fraudster built lookalikes for both law firms, so each side was talking to a fake version of the other. After the wire went out, the fake defense lawyer told the real plaintiff's firm that the check was on its way, which bought about a month.
4. The cash-out. The money lands in an account controlled by a money mule, someone recruited to move funds and sometimes unaware of the scheme. In Studco, the account belonged to a woman who had answered a job advertisement and evidently believed she was handling real estate funds. The money moves again within hours or days. In 218 Broadway, LLC v. J.P. Morgan Chase Bank, N.A. (S.D.N.Y. Aug. 14, 2026), the complaint alleged that the receiving account was essentially drained within a day of being opened.

Stage one matters even when the lookalike gets all the attention. If a mailbox at your company was accessed, you may also have a data breach to deal with, and removing the domain does nothing about the intruder who may still be reading your mail. See Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

The legal tools, sorted by speed

Most writing on this subject starts with trademark law because that is where the lawyers are. A victim should think in order of the clock.

The tools do not exclude each other, with one trap discussed below, and in a serious incident several run at once.

ICANN's DNS abuse rules: the tool most lawyers underuse

For years, registrars had a general duty to take reports of abuse and respond appropriately, which left a good deal of room for doing very little. ICANN's 2024 global amendments changed the contract language, effective 5 April 2024.

Section 3.18 of the Registrar Accreditation Agreement, as restated by the 2024 Global Amendment, now does four things. Section 3.18.1 requires a published abuse contact, confirmation of receipt, and "reasonable and prompt steps to investigate and respond appropriately to any reports of abuse." It also defines DNS Abuse as "malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse listed in this Section)." Section 3.18.2 is the new substance: a registrar with actionable evidence that a name it sponsors is being used for DNS Abuse "must promptly take the appropriate mitigation action(s) that are reasonably necessary to stop, or otherwise disrupt" that use, with the response allowed to vary according to the severity of harm and possible collateral damage. Section 3.18.3 requires a 24/7 contact for law enforcement and similar authorities, with well-founded reports reviewed within 24 hours. Section 3.18.4 requires published procedures and recordkeeping.

Registry operators got a parallel duty in Specification 6, Section 4 of the base Registry Agreement. A registry that reasonably determines from actionable evidence that a name is being used for DNS Abuse must promptly act, and at a minimum it must either refer the name and evidence to the sponsoring registrar or take direct action. ICANN's November 2024 renewal of the .com agreement with Verisign added DNS Abuse mitigation requirements for .com as well.

What "actionable" and "prompt" mean

ICANN's February 2024 advisory on the DNS abuse obligations explains the terms. Evidence is actionable when it lets the registrar make a reasonable determination, and the registrar must look at what it can reasonably reach, including name servers, account activity, and the content of the reported page. A screenshot of a phishing page with the complete URL is the classic example. "Promptly" has no fixed number of hours, and timing gets reviewed case by case in light of the potential harm.

The advisory also draws a distinction every report writer should absorb. A maliciously registered domain, created for fraud, can simply be suspended, typically with a clientHold status that takes it out of the DNS. A compromised domain, a real business's website that was hacked, usually should not be suspended because that would take down the innocent owner's site and mail, so the registrar may notify the owner or host instead. Your report should say which one you have and why. A name registered last week, one letter from your mark, with no history, is an easy call. Say so.

Where the contract runs out

Four limits shape how to use this tool.

The definition has an edge. The security advisory ICANN incorporates (SAC115) describes phishing as tricking a victim into revealing sensitive personal, corporate, or financial information. ICANN's complaint guide lists fraud as something other than DNS Abuse, handled under different requirements. A pure invoice fraud, where a lookalike email asks for a payment and collects no password, is a harder fit than a fake login page. It is wise to describe it accurately and specifically: the domain impersonates a named company, the email solicits bank and financial action under a false identity, and the mail is spam serving as a phishing delivery mechanism if that is true. The general duty in § 3.18.1 to investigate and respond to any report of abuse still applies, and most registrars' terms of service separately bar fraud.

It stops at the gTLD line. ICANN's contracts reach generic TLDs. Country codes such as .co, .uk, and .io are governed by their own managers, whose policies vary. Fraudsters know this.

It operates at the second level. Registrars act on the whole domain. If the abuse sits on a subdomain of a free hosting service or a hacked site, go to the host.

You can't sue on it. The registrar's promises run to ICANN. In Register.com, Inc. v. Verio, Inc., 356 F.3d 393 (2d Cir. 2004), the Second Circuit, addressing an earlier version of the agreement with a no-third-party-beneficiaries clause, accepted ICANN's position that people aggrieved by a registrar's breach belong in ICANN's grievance process and cannot enforce the registrar's promises in court. Your recourse is a complaint to ICANN Contractual Compliance, filed after you have given the registrar a reasonable time and with proof that you did.

ICANN has shown it will enforce. In its October 2026 report covering 5 April 2024 through 5 August 2026, it counted more than 650 investigations, more than 570 resolved, about 66 percent ending in action to stop the abuse and about 8 percent in action to disrupt it, eight notices of breach, and one registrar termination. In about 21 percent of resolved cases the contracted party found no actionable evidence and explained why. In a June 2026 post, ICANN complained about a high volume of complaints that are out of scope or too thin to act on, so quality counts. A policy development process on "associated domain" checks, which would push registrars to look at other names tied to the same abuse, published its initial report for comment in August 2026 and has not produced a binding rule. For now, ask the registrar in your report to look at the account's other names. It may do so even without a rule requiring it.

Finding the human behind the proxy

Public lookups through RDAP (the successor to WHOIS, available at ICANN Lookup) usually show the registrar and redacted registrant fields. Those fields still tell you where to send the report. For the identity of the customer, a requester can ask the registrar directly or use ICANN's Registration Data Request Service, which the ICANN Board in late 2025 extended for up to two years beyond its pilot while policy work continues. Participation is voluntary and covers only part of the market, and disclosure is not guaranteed. Expect fake data anyway. The bad-faith factors in the ACPA treat false contact information as evidence of bad faith, and that evidence is often the most useful thing a registrant lookup produces.

Hosts, CDNs, mail providers, and blocklists

None of these is bound by ICANN's contracts, and all of them respond to clear reports because they have terms of service and reputations to protect.

Hosts and mail providers. Look up the A and MX records to find who actually provides the service. Google Workspace, Microsoft 365, and smaller mail hosts have their own abuse channels, and closing the mailbox stops the invoices even while the domain stays registered. If the fake site copied your site, a notice under 17 U.S.C. § 512(c)(3) gives the host a statutory reason to act, because a safe harbor is at stake. The notice needs a good-faith belief, and misrepresentation carries liability under § 512(f); fair use must be considered first under Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016). For the mechanics, see Filing a DMCA Takedown Notice: A Practical Checklist.

Knowledge can also matter to a host's own exposure. In Louis Vuitton Malletier, S.A. v. Akanoc Solutions, Inc., 658 F.3d 936 (9th Cir. 2011), a web host and its principal answered in contributory infringement after a jury heard that they had disregarded notices about counterfeit-selling sites on their servers. A notice is therefore worth more than a courtesy. It starts a record of knowledge. Keep that in reserve and do not lead with it, because the first goal is cooperation.

CDNs and reverse proxies. A service such as Cloudflare sits in front of a site, so DNS shows the CDN's addresses and hides the true host. The CDN often is not the host and may say so, but it runs an abuse process, may pass the complaint to the origin host, and may identify that host to a complainant. Its role is a real one, as Tkach shows below.

Browser and blocklist reports. Reports to Google Safe Browsing and Microsoft's SmartScreen, and to security vendors, can put warnings in front of most web users even when the registrar is unresponsive. These reports need no legal theory. They do little for email-only fraud with no website, though many mail security products use similar feeds.

Your own gateway. The fastest protection for your staff is a block on the domain at your mail gateway and DNS filter, which IT can usually add within minutes. Pair it with a search of mail logs for prior messages to or from that domain, because the first report is rarely the first message.

The URS and the UDRP

Both procedures bind registrants by contract through the registration agreement. Both are described at length in Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking and Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP. The points below are the ones specific to fraud.

Uniform Rapid Suspension

The URS was built for clear-cut abuse in new gTLDs and has since been adopted by some legacy TLDs through their contract renewals, including .org. The .com and .net agreements do not include it, and that limits its use, since many impersonators choose .com to look respectable. When the URS is available, its features suit phishing. Under the URS Procedure, the registry must lock the name within 24 hours of the provider's notice, which stops transfers while leaving the name resolving. The registrant has 14 calendar days to respond. The complainant needs a word mark that is registered and in current use, validated by a court, or protected by statute or treaty. The burden is clear and convincing evidence, with no genuine issue of material fact. The sole remedy is suspension for the balance of the registration, with an option to extend for one year at commercial rates. ICANN's URS FAQ puts the complainant's cost in the range of $300 to $500; check the provider's schedule.

Note what the lock does not do. A locked name keeps resolving, and any mail keeps flowing, until the decision. Run the abuse report alongside it.

The UDRP

The UDRP applies across all gTLDs, including .com, and many ccTLDs have adopted it or something like it. The complainant must show (i) a name identical or confusingly similar to a mark in which it has rights, (ii) no rights or legitimate interests on the respondent's part, and (iii) registration and use in bad faith. On the first element, the WIPO Jurisprudential Overview 3.1 says at section 1.9 that a name varying a mark through typosquatting is considered confusingly similar, at section 1.8 that adding other terms does not avoid similarity, and at section 1.11 that the TLD is generally disregarded. Common-law marks can qualify, which helps a small business with no registration.

On the second and third elements, phishing is about as good as facts get. WIPO's section 3.1.4 describes use for per se illegitimate activity such as phishing as manifestly evidence of bad faith, and it says such use can never confer rights or legitimate interests. Section 3.4 addresses a question invoice-fraud victims face directly: a name with no website can still be used in bad faith, including by sending email, phishing, identity theft, or malware distribution. Attach the emails. Section 3.6 notes that a respondent's intentional use of a privacy or proxy service merely to hide its identity may support bad faith. Section 2.13.1 lists phishing, identity theft, and other types of fraud among the illegal uses that can never confer rights, and section 1.7 says that fraudulent phishing emails trading on a complainant's reputation can inform even the first-element comparison, particularly for an unregistered mark.

Under the UDRP Rules, the registrar must lock the name and provide the registration data within two business days of the provider's verification request. That gives the complainant, for a filing fee, the identity details the registrar otherwise withholds. The respondent has 20 days to respond, and the panel decides within 14 days of appointment. A transfer order is implemented after a 10-business-day window under paragraph 4(k) of the policy unless the loser files suit. WIPO's fee schedule lists $1,500 for a single panelist and one to five names. For the mechanics of filing, see How to File a UDRP Complaint for Domain Name Disputes.

The UDRP is not an emergency remedy, and a domain used for fraud will probably have done its damage before the decision. Its value comes after the fire: it removes the name from circulation so that it does not return in the next campaign, and transferring the name lets you hold it. Also note that when you win control of a name that received misdirected email, you may start receiving sensitive third-party messages. Have a plan for that mailbox.

The Anticybersquatting Consumer Protection Act

The ACPA, 15 U.S.C. § 1125(d), was enacted in 1999 to deal with people who registered famous names to sell them back. Phishing was not what Congress had in mind, but the text is broad enough, and the two questions that matter have good answers.

Typos count

Shields v. Zuccarini, 254 F.3d 476 (3d Cir. 2001), is the case. Joe Shields, a Michigan graphic artist, ran joecartoon.com, known for animations such as "Frog Blender." John Zuccarini, a self-described wholesaler of domain names, registered joescartoon.com, joecarton.com, joescartons.com, joescartoons.com, and cartoonjoe.com. The sites trapped visitors in a series of advertisements, and Zuccarini earned between ten and twenty-five cents a click. When Shields sued, Zuccarini changed the pages to a "political protest" against animal cruelty in cartoons.

Zuccarini argued that the statute reached cybersquatting, that what he was doing was something else, and even supplied the name "typosquatting" for it. The Third Circuit said the argument ignored the plain language and purpose of the statute. It held that a reasonable reading of "confusingly similar" covers "the intentional registration of domain names that are misspellings of distinctive or famous names, causing an Internet user who makes a slight spelling or typing error to reach an unintended site." It affirmed the district court's rejection of the protest story as a spurious explanation, upheld $10,000 per domain, and upheld a fee award of $39,109.46 on the finding that the case was exceptional.

The court also made a point phishing plaintiffs can use: nothing in § 1117(d) requires a court to weigh how long the infringement lasted before setting the amount. A fraud domain that lived for nine days can still draw a real award.

Combination names fare the same way. In DaimlerChrysler v. The Net Inc., 388 F.3d 201 (6th Cir. 2004), foradodge.com was confusingly similar to the DODGE mark because it simply placed the mark in a prepositional phrase, and the court observed that courts generally treat a name incorporating a mark as confusingly similar. In Coca-Cola Co. v. Purdy, 382 F.3d 774 (8th Cir. 2004), my-washingtonpost.com, mymcdonalds.com, and drinkcoke.org were all confusingly similar.

"Bad faith intent to profit" fits a thief

The element that might seem awkward, intent to profit "from that mark," works well in fraud cases. The statute's nine factors in § 1125(d)(1)(B)(i) are not exclusive. Several fit almost perfectly: no rights in the name (I), not the registrant's legal name (II), no bona fide prior use (III), intent to divert consumers in a way that harms goodwill (V), false contact information (VII), and multiple confusing registrations (VIII). The safe harbor in § 1125(d)(1)(B)(ii), for someone who reasonably believed the use was lawful, cannot help a person sending fake invoices.

Purdy reads "profit" generously. An anti-abortion activist used names built on famous marks to reach his websites and offered to stop in exchange for space on The Washington Post's editorial page. The Eighth Circuit treated that offer as evidence of bad faith intent to profit, noting that profit includes an attempt to procure an advantageous gain or return. A person who borrows your name so your customers will send him their money is seeking gain from the trust your mark carries. Published appellate authority on this exact application is thin, because phishers rarely appear to litigate it, and pleadings should walk through the factors rather than assume the point.

The contrast is with criticism. In Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005), a critic's fallwell.com, an obvious misspelling, carrying a site that looked nothing like the Reverend Falwell's and sold nothing, survived both infringement and ACPA claims. See also Lucas Nursery & Landscaping, Inc. v. Grosse, 359 F.3d 806 (6th Cir. 2004). Those cases mark the boundary and should give pause before anyone uses these tools on a site that criticizes a company. Misspelling alone is not fraud. Reports and complaints need to show the impersonation.

The proof and the mark

Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002), held that bad faith under the ACPA need only be shown by a preponderance, rejecting the argument for clear and convincing evidence. The mark must be distinctive when the domain was registered, or famous at that time for the dilution prong. It need not be registered with the USPTO for § 1125(d)(1), though a registration makes everything easier, and an unregistered descriptive name needs proof of acquired distinctiveness. For the small business, this is often the real obstacle. A generic-sounding company name with no registration and a local reputation may give the court, and the UDRP panel, little to protect. A trademark search (marksy.us is one place to start) and an application well before any incident cost little compared with learning this during one.

Remedies include forfeiture, cancellation, or transfer under § 1125(d)(1)(C), plus statutory damages from $1,000 to $100,000 per domain at the plaintiff's election under § 1117(d). Under § 1117(e), knowingly supplying materially false contact information to a registrar creates a rebuttable presumption of willfulness. Damages can get large on paper: in Verizon California Inc. v. OnlineNIC, Inc., 647 F. Supp. 2d 1110 (N.D. Cal. 2009), a default judgment of $33.15 million arose from 663 names, though the court required Verizon to prove up the proper per-violation amount in an adversarial proceeding once the defendant appeared. Collecting from an anonymous fraudster is a different matter. For the phishing victim, the transfer and the factual findings tend to matter more than the number.

Intermediaries: protected, but not out of reach

The statute protects registrars in three ways. Under 15 U.S.C. § 1114(2)(D), a registrar that disables a name in compliance with a court order or a reasonable policy is shielded from monetary relief, and it owes no damages for registering or maintaining a name for another absent bad faith intent to profit. That first shield is a useful thing to mention when asking a nervous registrar to act. Under Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013), there is no cause of action for contributory cybersquatting. And Lockheed Martin Corp. v. Network Solutions, Inc., 194 F.3d 980 (9th Cir. 1999), rejected contributory infringement against a registrar performing routine translation.

A proxy service stands on different footing if it is the registrant of record or acts as more than a passive conduit. Solid Host, NL v. Namecheap, Inc., 652 F. Supp. 2d 1092 (C.D. Cal. 2009), refused to treat a registrar's separate anonymity service as automatically sheltered by the registrar safe harbors, though its discussion of contributory liability predates Petroliam. Meta's long-running suit in Facebook, Inc. v. OnlineNIC Inc. (N.D. Cal.) alleged that a registrar and affiliated proxy service registered names used for phishing, and the case produced an escrow order and a 2025 contempt ruling, which shows both the theory's reach and the years it can take.

False statements have consequences

Section 1114(2)(D)(iv) makes a person who causes a registrar to act through a knowing and material misrepresentation liable for the registrant's damages, costs, and fees. Section 1114(2)(D)(v) lets a registrant sue to establish that its registration is lawful. Under UDRP Rule 15(e), a panel can declare reverse domain name hijacking. Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001), and Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003), confirm that the losing registrant can take a UDRP transfer to federal court. Check the facts first. A small business that happens to have a similar name, say a hypothetical Northgate Alloys in Oregon with no connection to the fraud, is not a phisher, and an overheated report can create real liability.

Reaching an anonymous registrant: in rem and Doe actions

The in rem action

Section 1125(d)(2) lets a mark owner sue the domain name itself in the district where the registrar, registry, or other authority that registered or assigned the name is located. For .com and .net, Verisign's location in Virginia makes the Eastern District of Virginia the usual forum. Two doors open it: the owner cannot obtain personal jurisdiction over the person who would have been the defendant, or through due diligence cannot find that person after sending notice to the registrant's postal and email addresses and publishing as the court directs. Those steps count as service under § 1125(d)(2)(B). The remedy is limited to forfeiture, cancellation, or transfer, with no damages.

Harrods rejected the due process objection that the names themselves lacked minimum contacts, where the claim concerns the property itself. It also held that an in rem plaintiff may, in appropriate circumstances, pursue infringement and dilution claims as well as bad faith claims. Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002), held that the action must start in the registrar's or authority's district and no other. See also Cable News Network L.P. v. CNNews.com, 162 F. Supp. 2d 484 (E.D. Va. 2001), in which the .com registry's location in Virginia supported in rem jurisdiction over a Chinese company's name, even after the registrant moved it to a Chinese registrar.

The trap is in the text. Under § 1125(d)(2)(D)(i), once the registrar or registry receives a filed, stamped complaint, it must deposit documents establishing the court's control and must "not transfer, suspend, or otherwise modify the domain name during the pendency of the action, except upon order of the court." Read literally, filing can stop a suspension that was about to happen. If a registrar is on the verge of pulling the name, let it, or be ready to ask for an order at once. A worked example follows.

Worked hypothetical. Suppose a Spokane title company's real name is marigoldtitle.com, and fraudsters register marigold-title.com at a large U.S. registrar through a proxy. The company sends an abuse report on Monday. Its lawyer, eager to do something more, files an in rem complaint on Tuesday in Virginia and sends it to the registrar and registry. On Wednesday, the registrar's trust and safety analyst, who had been about to apply a hold, sees the complaint and the statute's bar on modifying the name, and refers it to legal. The domain keeps working for another week while a motion for an order is prepared. The better sequence would have been to press the abuse report for 48 hours, confirm suspension, and then file to secure a transfer, or to file together with an emergency motion that asks for the order the statute contemplates. The in rem case remains valuable. Timing it is the skill.

The Doe action

If you want a defendant, you can sue Does and take early discovery. Rule 26(d)(1) bars discovery before the Rule 26(f) conference unless a court orders otherwise, and courts grant leave on good cause. Columbia Insurance Co. v. seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999), a domain case, is the common starting point. The plaintiff should identify the missing party with enough specificity to show it is a real person who could be sued, describe its efforts to find the defendant, show the claim could survive a motion to dismiss, and explain why the discovery will lead to identifying information.

Subpoenas under Rule 45 can go to the registrar, proxy service, mail provider, host, and payment processor. For the mail provider, the Stored Communications Act limits what you can get. 18 U.S.C. § 2702 bars disclosing message content in response to a civil subpoena, while permitting non-content customer records to go to a non-governmental party. Ask for login IP logs, account creation records, and payment records, and do not ask for the emails.

Service on a foreign defendant runs through Rule 4(f). Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002), held that court-directed service under Rule 4(f)(3) is neither a last resort nor extraordinary relief, and approved email for a business that had structured itself to be reachable that way. The rule forbids methods barred by international agreement, however. Where the Hague Service Convention applies, its interaction with email service is contested, particularly for countries that object to service through postal channels. Volkswagenwerk AG v. Schlunk, 486 U.S. 694 (1988), and Water Splash, Inc. v. Menon, 581 U.S. 271 (2017), frame that inquiry. District courts have divided, and the Convention by its terms does not apply where the defendant's address is unknown, so check your district's recent orders. The in rem path avoids much of this.

Emergency orders against phishing infrastructure

Microsoft's Digital Crimes Unit has done more than anyone to build the template. Beyond the 2021 homoglyph case, Microsoft reported a December 2023 order in the Southern District of New York (No. 23-cv-10685) against the group it calls Storm-1152, and in 2025 an order from the same court to seize 338 websites tied to the RaccoonO365 phishing service. These matters have generally produced ex parte orders directing registries and registrars to disable or transfer the names. You can't assume that a smaller plaintiff with less evidence will get the same order, but the structure is available to any party who can make the showing.

The pleadings repay study. Microsoft's 2021 complaint rested on the Computer Fraud and Abuse Act, the Stored Communications Act, the Virginia Computer Crimes Act, and common-law trespass and conversion. It had no Lanham Act count, because the names imitated Microsoft's customers and not Microsoft itself. That is a useful model for a victim who has no mark in the imitated name but can prove someone broke into its mailboxes.

The showing

A TRO without notice requires specific facts in an affidavit or verified complaint showing immediate and irreparable injury before the adverse party can be heard, plus counsel's written certification of efforts at notice and reasons notice should not be required (Fed. R. Civ. P. 65(b)(1)). It expires in no more than 14 days unless extended for good cause or by consent. The Supreme Court has stressed how narrow the ex parte exception is in Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (1974). The merits standard comes from Winter v. NRDC, 555 U.S. 7 (2008).

Two features help a phishing plaintiff. 15 U.S.C. § 1116(a), as amended by the Trademark Modernization Act, gives a rebuttable presumption of irreparable harm on a showing of likely success, and it expressly reaches violations of § 1125(d). And the reason for no notice is usually credible, because a fraudster warned of the suit can move the name or the mail in minutes. Delay cuts the other way: see Trademark Preliminary Injunctions After the Trademark Modernization Act: The Presumption of Irreparable Harm and the Delay Trap. For the general procedure, see Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

Binding the people who can actually do something

The defendant won't obey anything. The order's value lies in who else it reaches. Rule 65(d)(2) binds those with actual notice who are in active concert or participation with the party.

Arista Records, LLC v. Tkach, 122 F. Supp. 3d 32 (S.D.N.Y. 2015), remains the leading case on CDNs. After a TRO against a pirate version of Grooveshark, the operators moved to a new domain, and an anonymous user signed up for a free CloudFlare account. CloudFlare argued that its systems passively and automatically served the names. Judge Nathan disagreed. CloudFlare knew of the order, and its authoritative name servers connected users to the site, which the court said quite fundamentally assisted the violation. The court relied in part on an unreported order in The North Face Apparel Corp. v. Fujian Sharing Import & Export Ltd. (S.D.N.Y. June 24, 2011), involving Public Interest Registry.

On the other side stands Blockowicz v. Williams, 630 F.3d 563 (7th Cir. 2010). A website that merely continued to host defamatory posts after an injunction, doing nothing new, was not in active concert, because inaction after the order is not aiding and abetting. The two decisions can be reconciled, and it is useful to do so when drafting. Tkach involved new service provided after notice to a defendant that was evading the order. Blockowicz involved a pre-existing arrangement and silence. Serve the order early, make it explicit about future services, and request specific steps. Courts may also order registries and registrars directly, sometimes invoking the All Writs Act, 28 U.S.C. § 1651, which some large-plaintiff orders do. For enforcement mechanics, see Contempt and Enforcing Injunctions: Civil, Criminal, and What an Order Actually Compels. Readers who know mass counterfeiting cases will recognize the pattern from Counterfeiting Seizure Orders and Schedule A Litigation: Fighting Fakes in Federal Court.

Can a court freeze the money?

Sometimes. Grupo Mexicano de Desarrollo, S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308 (1999), bars a federal court from freezing a defendant's general assets to secure a future money judgment. The Court distinguished suits seeking equitable relief in the assets themselves. Courts have since allowed freezes tied to equitable monetary claims, as in the Lanham Act profits setting of Levi Strauss & Co. v. Sunrise International Trading Inc., 51 F.3d 982 (11th Cir. 1995), a pre-Grupo decision, so check how your circuit treats such freezes now. A victim who can trace identifiable funds to a specific account should plead constructive trust and restitution, and identify the money. Rule 64 also brings in state attachment law. Practically, by the time such a motion gets filed, the FBI process has usually either already caught the money or missed it.

The criminal and regulatory overlay

Registering a confusing domain is not in itself a federal computer crime. Be careful with the statutes.

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, reaches accessing a computer without authorization. A lookalike domain doesn't access anyone's computer, and receiving a fraudulent email isn't intrusion. The claim arises when credentials get stolen and used to log in to a mailbox or portal, which is common at stage one. After Van Buren v. United States, 593 U.S. 374 (2021), a stolen password is still a classic gate violation. A civil claim under § 1030(g) requires one of the listed harms, usually $5,000 in loss during a one-year period, and the loss concept centers on technological harm and response costs. A wire sent to a fraudster may not count as "loss" in that sense, while investigation costs usually do. See The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement. The Stored Communications Act, 18 U.S.C. § 2701, covers unauthorized access to stored mail.

Wire fraud, 18 U.S.C. § 1343, fits squarely, as do aggravated identity theft, money laundering, and false-header email fraud under 18 U.S.C. § 1037. There is no private right of action under § 1343, but mail and wire fraud are RICO predicates under 18 U.S.C. § 1962, with treble damages under § 1964(c), and Bridge v. Phoenix Bond & Indemnity Co., 553 U.S. 639 (2008), holds a plaintiff need not have relied personally on the misrepresentation. Pleading is demanding under Rule 9(b), and RICO is worth adding only when there is a real pattern and a real target. If prosecutors catch someone, restitution under 18 U.S.C. § 3663A and forfeiture under 18 U.S.C. § 981 become the realistic recovery channels, and 18 U.S.C. § 3771 gives victims rights to notice and to be heard.

The FTC's Impersonation Rule, 16 C.F.R. Part 461, makes it a violation to falsely pose as a business or its officers in or affecting commerce. It gives the FTC a direct route to monetary relief. It gives victims no private claim, though a report through ReportFraud.ftc.gov feeds its data.

State law can add real force. California's Anti-Phishing Act of 2005, Cal. Bus. & Prof. Code §§ 22948 to 22948.3, bars using the internet to solicit identifying information by posing as a business without authority, and lets an adversely affected trademark owner seek an injunction and the greater of actual damages or $500,000, with multiple violations from a single action or conduct treated as one. Common-law fraud, conversion, and unfair competition also apply, though the question is usually whom to sue.

The Financial Fraud Kill Chain

The most valuable piece of government machinery here is not a statute. The IC3 Recovery Asset Team, created in February 2018, works with banks and FBI field offices to freeze funds through the Financial Fraud Kill Chain (FFKC). The 2025 IC3 report records 3,900 incidents, $1,163,919,846 in attempted theft, and $679,013,183 frozen, a 58 percent success rate. Domestic matters accounted for 3,574 incidents and about $507 million frozen; international matters, 326 incidents and about $172 million, working through FinCEN's Rapid Response Team and FBI legal attachés. The domestic process can reach beyond the first recipient bank if you give the team "second hop" details.

The report's instructions are plain. Time is of the essence. Contact your financial institution at once and request a recall of funds with any needed indemnification documents, and file at ic3.gov regardless of the amount with full transaction details. The FBI's domestic process summary tells victims to ask for a recall or reversal and a hold harmless letter or letter of indemnity. Practitioners often speak of a 72-hour window. The FBI's published materials we reviewed do not state a fixed public cutoff, and the FBI has acted outside its usual time frames in large cases, but the money tends to leave quickly, so treat the first hours as the only ones you can count on.

Who bears the loss

After the bank says no, the argument begins. It tends to run in three directions: at the banks, between the trading partners, and at the insurer.

Against the banks: Article 4A

UCC Article 4A, adopted in every state, governs wholesale funds transfers. The Federal Reserve's Regulation J, 12 C.F.R. Part 210, applies it to Fedwire. The article draws a line victims often miss. If an intruder logged in and sent the wire, the order may be unauthorized, and §§ 4A-202 through 4A-204 put the loss on the bank unless the customer agreed to a commercially reasonable security procedure and the bank followed it in good faith. If your employee sent the wire because a fake invoice fooled her, the order is authorized, and those sections do not help.

The account-takeover cases show the first path. In Patco Construction Co. v. People's United Bank, 684 F.3d 197 (1st Cir. 2012), the First Circuit held a bank's security system commercially unreasonable where its system flagged six fraudulent withdrawals as high risk, yet the bank neither monitored the transactions nor notified the customer before completing them. In Choice Escrow & Land Title, LLC v. BancorpSouth Bank, 754 F.3d 611 (8th Cir. 2014), a customer that declined the dual-control option and signed a waiver bore a $440,000 loss.

The lookalike cases mostly fall on the second path, where the live question is misdescription. Section 4A-207(b) provides that when a payment order identifies the beneficiary by both name and number and they refer to different people, a beneficiary's bank that does not know of the mismatch may rely on the number, and it need not determine whether they match.

Studco is now the leading appellate reading. The account named "Olympic Steel Inc" in the payment order was actually held by Lesa Taylor. The credit union's software generated warnings on every deposit, "Tape name does not contain file last name TAYLOR," but it produced hundreds to thousands of such warnings daily, and no one read them. The district court found the bank's lack of reasonable routines amounted to actual knowledge. The Fourth Circuit reversed, and its opinion deserves close attention:

• "Knowledge" under Article 4A means actual knowledge, not constructive knowledge, and the due-diligence language in UCC § 1-202(f) tells when an organization receives knowledge. It does not redefine it.
• A beneficiary's bank has no duty to adopt routines for catching conflicts. An unread alert generated by a machine isn't knowledge.
• The bailment theory failed as well.
• The risk falls on the person who dealt with the thief, whose remedy lies against the recipient, the thieves, or potentially its own bank.

The court also recited the fact that hurts: Studco's emails came from Olysteel.net while the real domain was Olysteel.com, and the opinion catalogs the bad punctuation, inconsistent phone numbers, and the oddity of an Ohio company banking at a Newport News credit union. The Clearing House, Nacha, and credit union trade groups appeared as amici, which suggests how much the industry cared. The court's reasoning accords with First Security Bank of New Mexico, N.A. v. Pan American Bank, 215 F.3d 1147 (10th Cir. 2000).

Two further limits matter. Privity: in Approved Mortgage Corp. v. Truist Bank, 106 F.4th 582 (7th Cir. 2024), the Seventh Circuit held that an originator could not bring its § 207 claims directly against a remote beneficiary's bank, following the policy of Grain Traders, Inc. v. Citibank, N.A., 160 F.3d 97 (2d Cir. 1998). Disclosure: under § 4A-207(c), the originator's bank can enforce the mismatch against its customer if it gave notice that payment might be made on the number, which it can prove with a signed writing, though any admissible evidence will do. In 218 Broadway, the court dismissed claims against both banks, finding that the wire form the customer signed said just that, and that the complaint did not support actual knowledge at the receiving bank or aiding and abetting. See also Hamlin Tec, Inc. v. JPMorgan Chase Bank N.A. (N.D. Ill. May 28, 2025), which granted summary judgment to the bank where the customer personally sent over $130,000 to an impostor's account.

There is one opening. Approved Mortgage also held that a negligence claim survived preemption to the extent it rested on what the bank did after the funds were credited, in that case letting half a million dollars go out in cashier's checks from an account it had already flagged as suspicious. Article 4A, the court reasoned, doesn't govern the transferred funds indefinitely. That leaves room for a theory aimed at post-credit conduct, though the court did not decide whether any duty existed, and Studco's strong statements of Article 4A exclusivity will be cited against it. Actual knowledge also remains possible. A bank that personally reviewed the account before the deposit, or was told by the FBI or another bank about prior fraud, is in a different position. Plaintiffs' best early move is to send notice to the receiving bank immediately and specifically. Notice before the funds go out changes what the bank knows, and may change everything else.

Article 4A also explains why a "recall" is a request and not a right. Under § 4A-211, once the beneficiary's bank has accepted the order, cancellation requires the bank's agreement or a funds-transfer system rule, and it is effective only in limited situations, including a mistake that sent payment to a beneficiary not entitled to it. A canceling bank may require indemnity. That's where the FBI's hold harmless letter comes from.

Between the trading partners: who was best placed

If the bank is off the hook, the buyer and the seller turn on each other. The seller says it was never paid. The buyer says it paid exactly as instructed. No statute directly answers this, and courts borrowed from the UCC's check rules, which themselves put the loss on the party whose failure of ordinary care contributed to it.

Beau Townsend is the root of the modern cases. A hacker in the seller's sales manager's mailbox redirected $736,225 from a dealer buying twenty Ford Explorers. The district court gave the seller summary judgment because it had not been paid, despite finding both sides negligent. The Sixth Circuit reversed in an unpublished opinion. Relying on Arrow Truck Sales, Inc. v. Top Quality Truck & Equipment, Inc., 2015 WL 4936272 (M.D. Fla. Aug. 18, 2015), and Bile v. RREMC, LLC, 2016 WL 4487864 (E.D. Va. Aug. 24, 2016), it said the factfinder must decide who "was in the best position to prevent the fraud," applying principles from UCC §§ 3-404 and 3-406 and apportioning by comparative fault if those principles govern. It also thought agency by estoppel gave useful guideposts.

The two cases it borrowed show the range. In Arrow, the buyer ignored conflicting emails with a different beneficiary, bank, location, and account, and bore a $570,000 loss even though the court found no one negligent in email security. In Bile, the plaintiff's lawyer knew someone had tried to divert the settlement to a London account and did not warn the other side; the plaintiff bore the $63,000 loss when defense counsel wired it after a convincing fake email.

The later decisions have sharpened into a list of red flags.

Thomas is the most instructive. It is published, the first California appellate treatment, and its discussion of call-backs may be the most useful passage in the entire body of law. The defense firm did call, which is more than many do. It called a number from the fraudulent email thread. The court said the right course was to find the number from a source extrinsic to the spoofed thread, such as the state bar's website or the firm's pleadings, and it noted that the lawyer delegated the follow-up to accounting staff. A call-back to a number the impostor supplied is no verification at all.

Three cautions apply. The rule is still young. Yangtze specifically noted that it wasn't deciding whether the best-position rule is correct, because no one challenged it on appeal, and Beau Townsend is unpublished. A state court might still reason from strict contract principles that a debt is discharged only by payment to the creditor, with the debtor bearing misdirection risk. Second, the party with the compromised mailbox can't assume it is safe or doomed; the question is comparative and factual, which is why Beau Townsend sent the case to trial. Third, contracts can answer the question in advance. A clause requiring payment-detail changes to be verified by telephone at a number in the original contract, and allocating loss for failure to do so, could avoid the whole argument. Home buyers meet the same fraud at closing, and those disputes often target the title agent; for the consumer side, see Scams, Fraud, and Elder Financial Exploitation: How They Work and What to Do.

Worked hypothetical: scoring the fight. A hypothetical Boise cabinet maker owes a hardwood supplier $212,000. An intruder in the supplier's mailbox emails from the supplier's real address with new bank details, then shifts to a combosquatted domain once the cabinet maker's bookkeeper replies. The new account is at a credit union in another state, in the name of an individual "doing business as" the supplier. The bookkeeper calls the number in the email, gets a friendly voice, and pays. A week later the supplier asks where the money is.

The supplier's weak points: it was slow to detect the intrusion, had no multi-factor authentication, and sent no warning after its IT consultant noticed strange mailbox rules three days earlier. Those facts resemble Bile. The cabinet maker's weak points: a changed bank, an unknown beneficiary, a different state, a call to the number in the suspect email, no comparison of domains. Those resemble Thomas and Yangtze. On these facts the supplier has the better of it under a best-position approach, though the three-day silence could produce an apportionment if the court follows Beau Townsend's comparative suggestion. Change one fact, so that the supplier's consultant had told it plainly that someone was trying to redirect customer payments, and the answer gets closer. Each side's lawyer should spend the first week preserving exactly those facts.

The insurer: a split that turns on nouns

A commercial crime policy typically covers "computer fraud" and "funds transfer fraud." Many now add fraudulent instruction or social engineering coverage, usually with a lower sublimit. The decisions divide along lines that reward reading the form.

Against coverage. Apache is the lookalike case. A caller followed by an email from petrofacltd.com, with a letterhead letter attached, led Apache to change bank details after calling the number on the fake letterhead. The Fifth Circuit, applying Texas law in an unpublished decision, vacated the judgment for Apache and rendered judgment for the insurer. The email was merely incidental to a chain of events including the call and approvals, and reading the clause to reach every scheme involving email would turn it into general fraud coverage. Pestmaster Services, Inc. v. Travelers Casualty & Surety Co., 656 F. App'x 332 (9th Cir. 2016), is cited for the same point, but it was a payroll-vendor embezzlement case, not an email impersonation case, and it held that "fraudulently cause a transfer" required an unauthorized transfer.

For coverage. In American Tooling Center, Inc. v. Travelers Casualty & Surety Co., 895 F.3d 455 (6th Cir. 2018), impersonator emails led a Michigan die maker to wire about $834,000. The court found a direct loss, because the money was gone with no intervening event, and rejected the insurer's attempt to confine computer fraud to hacking, as well as its exclusions. Medidata affirmed a judgment of about $5.8 million with interest under New York law on a clause covering entry of data into a computer system, but it reasoned that spoofing code changed how the email system displayed the sender. Ernst & Haas Management Co. v. Hiscox, Inc., 23 F.4th 1195 (9th Cir. 2022), read Pestmaster as limited to its embezzlement facts and reversed a dismissal of a $200,000 claim.

The dedicated form. Principle Solutions Group, LLC v. Ironshore Indemnity, Inc., 944 F.3d 886 (11th Cir. 2019), applied a fraudulent-instruction provision to a $1.7 million wire and affirmed for the insured, over a dissent arguing that a jury should decide whether a bank fraud department's inquiry broke the causal chain.

Notice what a lookalike changes. Medidata's logic rests on manipulation of the victim's own email system. A message that arrives honestly from the fraudster's own lookalike domain, with valid DKIM and SPF, has not altered anything in the victim's system, and an insurer can argue that case falls closer to Apache than to Medidata. American Tooling gives the insured the stronger response, since it did not require the fraud to make a computer do anything. Check the choice of law, the words "direct" and "directly," any sublimit, and any condition requiring call-back verification. Give notice fast. See Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.

What is still unsettled

• Whether the best-position rule displaces ordinary contract discharge. Most courts that have reached the issue use it. Few state high courts have. Its source in Article 3 is an analogy.
• Post-credit claims against a receiving bank. Approved Mortgage leaves room. Studco and the Article 4A exclusivity language push the other way.
• What actual knowledge means for AI-driven fraud monitoring. An alert nobody read isn't knowledge under Studco. Whether an automated system that scores and acts on mismatches, or a bank that has had specific notice about an account, is treated differently will produce the next set of cases.
• Coverage for pure lookalike fraud under computer-fraud clauses. See above.
• How far "active concert" reaches a CDN. Tkach is a district court decision on evasion after notice. Few appellate courts have dealt with it directly.
• Whether a payment-only fraud is "phishing" under ICANN's definition. Registrars and ICANN Compliance may read it differently, and the policy work under way may refine it.
• Hague Service Convention and email. The disputes continue, and courts have not lined up.

What to change before the next invoice

The legal analysis above points to a short list of practices, each of which also creates evidence that helps in the dispute.

For payors. Treat any change in remittance details as a fraud event until proven otherwise. Verify by telephone through a number from the vendor's original contract or master file, never from the message. Make the person who owns the relationship do the call, and write down the time and the person reached. Thomas shows that the lawyer who delegated the call to accounting got no credit for it.

For payees. Put your bank-change policy on your invoices: "We will never change our remittance details by email. Call us at the number in your contract." If you learn of an attempted diversion, warn your counterparties that same day. Bile shows the cost of silence.

For both. Compare domain names letter by letter when anything about payment changes. Display full addresses in the mail client. Require multi-factor authentication on mailboxes, and check for forwarding rules, since those are how fraudsters learn enough to be credible. Set your own DMARC to enforce, because it removes the easiest attack and shows ordinary care. Monitor new registrations and Certificate Transparency logs for strings containing your marks. Consider registering the most obvious variants defensively, with registry lock on the real domain, and see Domain Name Security and Recovery Checklist: A Practical Checklist. Register your name as a trademark, because almost every tool past the abuse desk requires one. Read your payment agreements and crime policy now, and add contract language if it would help.

Those who need to act right now should turn to the sequenced plan in Taking Down a Lookalike Domain in Days: A Practical Guide, the task list in Lookalike Domain Response Checklist: A Practical Checklist, and the templates in Lookalike Domain Toolkit: Abuse Reports, Registrar Demands, and UDRP and URS Outlines.

This article is general information about a fast-changing area, and it can't substitute for advice on the facts, contracts, and policies in your own situation. If a domain is live and money is moving, an hour with counsel who has done this before can help put the steps in the right order.

Related Documents

Related Articles

• Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP: the general body of domain law that this article applies to fraud.
• Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking: deeper treatment of the URS, ccTLDs, and in rem practice.
• Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back: when the fraudster takes your real name instead of imitating it.
• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: the litigation that can follow a mailbox compromise, and how to protect the forensic work.
• Hearsay and Business Records at Trial: Rule 803(6), Self-Authentication, and Getting Documents Into Evidence: getting registrar, bank, and mail logs admitted.

Related Guides

• Taking Down a Lookalike Domain in Days: A Practical Guide: the hour-by-hour plan for a business under attack.
• Choosing the Right Domain Name Dispute Procedure: A Practical Guide: picking among the UDRP, URS, and court.
• Recognizing and Responding to a Scam: A Practical Guide: the same emergency from the consumer's side.

Related Checklists

• Lookalike Domain Response Checklist: A Practical Checklist: printable tasks with the authority for each.

Related Toolkits

• Lookalike Domain Toolkit: Abuse Reports, Registrar Demands, and UDRP and URS Outlines: reports, letters, and outlines ready to adapt.