Detects potential BEC/advance-fee phishing in inbound messages by combining signals from newly registered sender domains and targeted financial services themes with NLU intent classification. The rule triggers when: (1) inbound messages originate from a domain registered in the last 90 days; (2) the message body contains at least two of the specified wealth-management keywords (e.g., luxembourg, wealth management, estate planning, full disclosure, licensed intermediary); and (3) the NLU classifier identifies intents related to advance_fee or bec with a confidence not labeled as low. This composite condition surfaces messages that resemble financial fraud or advance-fee scams. Source and methods include Whois lookup on the sender domain, content analysis of the thread body, and NLU-based intent detection. Severity: medium.