Compare competing explanations
Spoofing can involve a misleading display name or asserted address. A lookalike domain can resemble a familiar organisation while being separately controlled. Account compromise involves unauthorised access or use. A payment-diversion message may fit more than one route, so preserve the message chain and record the exact disputed instruction.
Use more than one source
Domain authentication helps assess domain use but does not prove personal authorship or legitimate intent. Available sign-in, mailbox, forwarding-rule and consent records may help evaluate account activity. Compare them with endpoints, recipient copies and authorised gateway records. A suspicious IP address or rule is a lead requiring context, not a complete finding on its own.
Coordinate the immediate response
Preservation must be coordinated with authorised containment and account protection. Do not leave a suspected compromise active simply to avoid changing evidence. Record necessary changes and who made them. Forensic examination addresses what the available material supports; it does not guarantee identification of an offender or recovery of funds. The agreed scope should distinguish retrospective analysis from operational response and any separate work by IT teams, banks or legal advisers.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.