RevK :verified_r: on Nostr: Wait, was this just faking sender email address? "The scam emails carried valid ...

Wait, was this just faking sender email address? "The scam emails carried valid domain authentication credentials that passed Revolut's security checks. Revolut only discovered the fraud after contacting the government agency separately to discuss the requests."

After all, replying to such email would have gone to correct government email.

Did they follow a link in the email to send data or some such, rather than replying to confirm before doing so?

Sounds sloppy to me.