Spend enough hours staring at registrar records and raw email headers and the trick stops looking clever. It starts looking lazy. The fraud desk pulled apart dozens of these domains this year, and the pattern almost never changes: one letter moves, one glyph gets swapped, and a finance team wires money to a stranger.
The address looked right. It had the company name, the right suffix, a tidy signature block, and a tone that matched every invoice that came before it. The only thing wrong was a single character sitting where the eye never checks. That one change is the entire business model behind a category of fraud that now drains billions from companies every year, and the uncomfortable part is how rarely technology is the thing that fails. People read the first and last few letters of a familiar word and let the brain fill in the rest. Attackers have built an entire economy on that shortcut.
This piece breaks down exactly how a swapped letter becomes a payout, which techniques attackers actually use, what the documented cases cost, and the specific controls that stop the scam before a transfer leaves the building.
The anatomy of a swapped letter
"Lookalike domain" is an umbrella term. Underneath it sit several distinct techniques, each exploiting a different weakness in how addresses are read. Knowing which is which matters, because the defense for one does nothing for another.
| Technique | How it works | Example against a real name |
|---|---|---|
| Typosquatting | Registers a common misspelling and waits for fingers to slip, or plants it inside an email. | paypa1.com in place of paypal.com |
| Homoglyph swap | Replaces a character with a visual twin from another alphabet or the number set. | Greek omicron for o, or the digit 0 for the letter o |
| Combosquatting | Keeps the real name intact and bolts on a word that reads as official. | paypal-security.com |
| Suffix swap | Reuses the exact name under a different top-level domain. | brand.co instead of brand.com |
| Transposition | Flips two adjacent letters that the eye glides over. | micrsooft in place of microsoft |
Homoglyph swaps are the quietest of the group. Lowercase L and uppercase I are near identical in many fonts. The digit zero and the letter o are separated by a sliver of width. Drop a Greek or Cyrillic character that renders the same as its Latin cousin and the address can pass a careful second look, not just a quick one.
Why the brain misses it every time
Human reading is predictive, not literal. The eye anchors on the opening and closing characters of a word and treats the middle as scenery. A finance manager who has processed four hundred invoices from a vendor is not inspecting the forty-first address character by character. They are confirming a shape they already trust. Attackers do not need to fool scrutiny. They need to arrive before scrutiny switches on, which is why the fraud is wrapped in urgency: a payment that is late, an account that is about to lock, a deal that closes today.
The numbers that make it worth the effort
This is not a fringe nuisance. According to the FBI Internet Crime Complaint Center, business email compromise, the fraud category lookalike domains most often feed, sits near the top of every annual loss report.
| Figure | What it represents |
|---|---|
| $2.77B | Reported BEC losses in 2024 across 21,442 complaints |
| $3.05B | Reported BEC losses in 2025 across 24,768 complaints |
| $20.8B | Total reported US cybercrime losses in 2025, up 26 percent |
| 86% | Share of 2025 BEC losses carried by wire and ACH transfers |
Two details inside those figures deserve attention. The first is that roughly nine in ten dollars lost to BEC move by wire or automated clearing house transfer, both of which are fast and close to irreversible once sent. The second is newer: the FBI tied more than 30 million dollars of 2025 BEC losses directly to attackers using artificial intelligence to draft convincing messages and clone voices. The swapped letter now travels inside copy that no longer reads like a scam.
For scale, a 2010 academic study by Tyler Moore and Benjamin Edelman estimated at least 938,000 typosquatting domains aimed at just the top 3,264 .com sites. The supply of lookalikes has never been the limiting factor. The limiting factor is whether a target checks.
Three cases where a letter did the work
Abstract risk convinces no one. Documented losses do. Each case below turns on impersonation of a trusted name, and each shows a different point where the swap could have been caught.
Google and Facebook, 2013 to 2015 (reported loss: more than $100 million) A Lithuanian man, Evaldas Rimasauskas, registered a company in Latvia carrying the same name as Quanta Computer, a real Taiwanese hardware supplier both tech giants genuinely paid. Posing as that vendor, he sent invoices and forged contracts to the accounts teams. Facebook paid roughly 98 million dollars and Google roughly 23 million before anyone questioned why a long-standing supplier suddenly banked in Latvia and Cyprus. He pleaded guilty to wire fraud in 2019, was sentenced to five years, and forfeited about 49.7 million dollars. Lesson: a familiar name plus routine volume beats individual judgment. Payments ran for two years because each one looked like the last. |
Ubiquiti Networks, 2015 (reported loss: $46.7 million) The networking firm disclosed in an SEC filing that impersonation and fraudulent requests aimed at its finance function moved 46.7 million dollars out of a Hong Kong subsidiary to third-party accounts overseas. An internal investigation found no system breach and no insider. The attack was entirely social, built on spoofed executive communications. The company clawed back 8.1 million dollars and chased the rest through courts and law enforcement. Lesson: no network was hacked. A transfer approval process trusted an inbound request it should have verified out of band. |
The single-character accounts-receivable swap (reported in a 2025 legal case study)A law firm documented a client hit by a spear-phishing attack in which a fraudster impersonated the client's CEO to an accounts-receivable manager, pulled a list of aged receivables, then registered a domain that differed from the real one by a single character to redirect customer payments. A UDRP complaint got the fraudulent domain placed under registrar lock, yet the attacker's email account stayed active despite repeated reports, so the scam kept running. Lesson: locking the domain is not the same as killing the mailbox. Takedown is a process, not a single action. |
How the scam actually unfolds
The playbook is consistent enough to map. Most campaigns the fraud desk reviewed moved through the same five stages.
| Stage | What happens |
|---|---|
| 1. Reconnaissance | Attackers learn who pays whom. Vendor names, finance contacts, and invoice cadence come from breached mailboxes, social profiles, and public filings. |
| 2. Registration | A lookalike domain is bought for a few dollars. Many are set up with valid SPF, DKIM, and DMARC records so they pass authentication checks and land in the inbox rather than spam. |
| 3. Insertion | The attacker joins or starts a payment conversation, often during a genuine thread, using the swapped-letter address with a matching signature. |
| 4. Pressure | A reason to hurry appears. Updated bank details, a closing deadline, an executive who needs this handled quietly before a meeting. |
| 5. Transfer | Money moves by wire or ACH. By the time the real vendor asks where their payment is, the funds have already been layered across accounts and borders. |
Red flags worth training the team on
Verification beats detection, but recognition buys the pause that triggers verification. These are the signals that should stop a payment cold.
| Signal | What it looks like in practice |
|---|---|
| A changed address, read character by character | rn reading as m, a swapped suffix, an extra hyphenated word, a digit standing in for a letter. |
| New banking details inside an existing thread | A vendor paid the same way for years suddenly routes to a different country or a new account. |
| Urgency plus secrecy | A request to act fast and keep it off the usual channels or away from a specific colleague. |
| Reply-to that differs from the display name | The name reads as the CEO, the return path points somewhere else entirely. |
| Pressure against normal controls | Any push to skip a second approval or a callback is itself the warning. |
The defense playbook that actually holds
Lookalike fraud sits at the seam between technology and habit, so the controls have to cover both. These separate cleanly into what a business owns and what each individual owns.
For the organization
Enforce a callback rule: any change to payment details is confirmed by phone on a number already on file, never a number in the email. Enforce DMARC on your own domain at a reject policy. Register the obvious lookalikes of your own brand before an attacker does. Monitor newly registered domains that resemble yours so a report reaches you first. Require dual approval on transfers above a set threshold.
For the individual
Read the full address, not the display name, and check the middle characters, not just the shape. Hover every link before clicking. Treat urgency as a prompt to slow down rather than speed up. Confirm any banking change through a channel you opened yourself. When something feels off by a degree you cannot name, that instinct is worth a two-minute phone call.
Why registrar lock is not the finish line
One case above makes a point worth isolating. Getting a fraudulent domain locked through a dispute process feels like victory, but a lock on the domain does not necessarily disable the mailbox running the fraud. Hosting providers, registrars, and email services are separate parties with separate processes. A complete takedown means reporting the domain to the registrar, the hosting provider, and browser safety services such as Google Safe Browsing and Microsoft SmartScreen, then confirming the email account itself is dead. Treat it as a checklist, not a single filing, and keep pressure on every party until each piece is confirmed closed.
Final verdict
After weeks of tracing these domains back through registrar records and comparing them character by character against the real thing, one conclusion holds steady: the swapped letter is not the clever part. The clever part is the timing and the trust wrapped around it. The glyph is cheap, interchangeable, and almost beside the point. What makes it pay is a payment process that treats a familiar name as proof, and a reader who confirms a shape instead of a string.
That is also the good news. A scam that depends on nobody checking is defeated by someone checking. Not with a bigger security budget, but with a callback rule that has no exceptions, a habit of reading the full address, and a culture where slowing down a transfer is rewarded rather than treated as friction. The companies that lost tens of millions were not careless. They were fast, trusting, and busy, which is exactly what the attack is built to exploit. Build one deliberate pause into the moment money moves and the swapped letter has nowhere left to go.