The packet is ready. The tone is flat, procedural, almost apologetic: the language of someone who has spent a decade in rooms where swagger gets you fired. Dane said it looks like nothing. In this business that is the highest compliment. One thing is left. The email needs to appear to come from Isabella. Not to her, from her: an internal instruction forwarded to Marc, telling him to authorise the pending compliance portal. Marc trusts Isabella's approvals without thinking about it. He has worked under her for three years. He doesn't read her emails anymore; he reads the shape of them. So the sign-off has to be hers. One wrong word and Marc's muscle memory flags it before his brain does. He has absorbed hundreds of her messages. He knows how she ends a sentence. She never realised she was training him to be a detection system. The cursor blinks in the empty field. **How does Isabella sign her internal approvals?** - *"Best regards, Isabella Laurent, Director of Risk Oversight"* [[SignatureTF|Use formal signature]] - *"Thanks, Isabella"* [[SignatureTW|Use friendly signature]] - *"Proceed. -I.L."* [[SignatureC|Use concise signature]] - *", Isabella"* [[SignatureA|Use casual signature]] <details> <summary>🔎 Behind the curtain: business email compromise</summary> <p>Pretending to be a trusted internal voice, usually a boss, to trigger a routine action is called <b>business email compromise</b> (BEC), and it is one of the most expensive crimes online: the FBI's complaint centre has logged tens of billions of dollars in BEC losses over the years, far more than headline ransomware. It rarely needs malware. It needs tone, timing, and a victim who trusts the shape of a familiar message, exactly what Marc does here.</p> <p><b>Defender's lesson:</b> verify money moves and access approvals out of band (a call back on a known number), and be most careful with the requests that look most routine.</p> </details>