Detect inbound messages where the sender uses a free email provider and presents a display name matching a known organizational display name. The rule flags emails whose local-part contains keywords like mail, office, staff, or executive; the subject matches the recipient's first name or display name; the sender's display name contains a space (indicating a likely full name); and the sender's display name is within the organization's display-name list while the sender's domain root is a free-provider domain. This pattern signals targeted impersonation of internal employees or executives for credential or financial fraud (BEC). Detection methods include sender analysis and content analysis.