It&#x27;s likely that their SMTP server accepts messages with an SMTP &quot;MAIL FROM&quot; command and&#x2F;or &quot;From&quot; header address that belongs to the company&#x27;s own domain without requiring authentication. The attacker then adds a &quot;Reply-To&quot; header so that replies will be sent elsewhere (likely a throwaway free email account).<p>This shows up in email clients as &quot;From: legit.name@example.com&quot;. When the recipient replies, they don&#x27;t notice that they&#x27;re sending a reply to a different address than the one their client claimed was the sender of the original message.<p>Receiving SMTP servers need to be configured to require SMTP authentication for messages claiming to originate from the company&#x27;s own domain.