This high-severity rule detects VIP impersonation during invoice/payment handoffs in inbound messages. It cross-references prior_threads to find a VIP within the organization who previously redirected billing or payment contact to an internal address (using language such as forwarding instructions or billing handoff phrasing). It then flags follow-up messages from external senders who arrive without the VIP and target a single internal recipient. The rule requires that the prior thread shows financial context (via NLU classifiers indicating invoice or payment topics with sufficient confidence) and that the current message includes payment-related content suggesting a handoff or billing context. Conditions include: the external sender’s text contains invoice/payment indicators and forwarding/billing directives, the message is addressed to exactly one internal recipient, and the sender is not part of a VIP-internal send-out with DMARC pass. The pattern aligns with BEC/fraud and social engineering tactics where adversaries monitor or fabricate invoice-related threads to insert themselves at the payment handoff point. The rule uses content analysis, NLU, sender and header analysis to determine context and legitimacy.