This rule detects inbound messages attempting VIP impersonation by embedding a known VIP's display name in the subject line within delimiters (quotes or common separators) and tying the context to prior thread history. It requires that either the VIP authored a previous message or the sender is mismatched, indicating impersonation. Observed lures include fabricated invoices, leadership recognition offers, and forwarded billing threads referencing real executives by name and company, across multiple sender domains. The detection anchors VIP identity signals from thread context, compares subject patterns against the VIP display name (with various delimiters such as quoted, slash-delimited, or mixed patterns), and cross-checks sender identity fields to filter legitimate correspondence. A machine-learned classifier on the current thread content must assign a non-low confidence topic related to financial communications (e.g., Financial Communications, Request to View Invoice, Payment Information). When matched, the rule flags a high-severity potential BEC/fraud scenario directed at VIPs. It uses content analysis, sender analysis, and header analysis across inbound messages, and leverages thread-context signals to reduce false positives.