This rule detects targeted BEC (business email compromise) attempts embedded in inbound messages that originate from free email domains. It leverages NLP classifiers to identify a BEC intent with at least medium confidence, along with a subtopic related to Out-of-Band Pivot and an urgency entity, signaling pressure to act quickly. It requires the message text to reference a meeting and to imply email-based responses only, a common social-engineering pattern to bypass phone verification. Additional sender validation checks compare the display name against the local-part of the sender address to discourage spoofing, and require the local-part to contain at least three digits, which can be characteristic of suspicious or randomized accounts. The rule only fires when there are no prior threads, and there are no links or attachments in the message, reducing noise from legitimate conversations. The detection relies on Natural Language Understanding, content analysis, and sender analysis to classify and correlate features across the email payload. When all conditions are met, the rule flags potential BEC/Fraud activity and maps to related attack techniques such as using free email providers and employing social engineering to pressure action. Overall, this rule strengthens inbound email security by catching explicit patterns of BEC that attempt rapid, email-only remediation, while attempting to minimize false positives through multi-facet checks on content, metadata, and context.