Cảnh báo: Email giả mạo nhà cung cấp đang “rút tiền” khỏi SME, và cách HimiTek dùng Automation để xử lý

Warning: Fake Supplier Emails Are Draining Money from SMEs — How HimiTek Uses Automation to Stop It

1. Chẩn đoán rủi ro cụ thể: Email nhìn rất thật, tiền mất cũng rất thật 9 giờ 17 phút sáng thứ Hai, phòng kế toán của một công ty...

1. Specific Risk Diagnosis: The Email Looks Real, and the Money Loss Is Real Too At 9:17 on a Monday morning, the accounting team of an industrial equipment distribution company...

import re
from difflib import SequenceMatcher

APPROVED_DOMAINS = ["supplier-a.com", "nhacungcapb.vn"]
APPROVED_BANK_ACCOUNTS = {"supplier-a.com": ["0123456789"]}
RISK_KEYWORDS = ["đổi tài khoản", "tài khoản mới", "thanh toán gấp", "urgent payment", "new bank account"]

def similarity(a, b):
    return SequenceMatcher(None, a, b).ratio()

def extract_bank_accounts(text):
    return re.findall(r"\b\d{8,16}\b", text)

def score_email(sender_domain, subject, body):
    score = 0
    reasons = []

    if sender_domain not in APPROVED_DOMAINS:
        near_match = max([similarity(sender_domain, d) for d in APPROVED_DOMAINS], default=0)
        if near_match > 0.8:
            score += 40
            reasons.append("Tên miền gần giống nhà cung cấp thật")
        else:
            score += 25
            reasons.append("Tên miền chưa được phê duyệt")

    content = (subject + " " + body).lower()
    for keyword in RISK_KEYWORDS:
        if keyword in content:
            score += 20
            reasons.append(f"Có từ khóa rủi ro: {keyword}")

    accounts = extract_bank_accounts(body)
    approved_accounts = APPROVED_BANK_ACCOUNTS.get(sender_domain, [])
    for acc in accounts:
        if acc not in approved_accounts:
            score += 35
            reasons.append(f"Số tài khoản lạ: {acc}")

    return {"risk_score": min(score, 100), "reasons": reasons}

result = score_email(
    sender_domain="supp1ier-a.com",
    subject="Cập nhật tài khoản ngân hàng thụ hưởng mới",
    body="Vui lòng thanh toán đơn hàng vào STK 9988776655 trong hôm nay."
)
print(result)

import re
from difflib import SequenceMatcher

APPROVED_DOMAINS = ["supplier-a.com", "supplierb.vn"]
APPROVED_BANK_ACCOUNTS = {"supplier-a.com": ["0123456789"]}
RISK_KEYWORDS = ["new bank account", "updated beneficiary", "urgent payment", "pay today", "change bank account"]

def similarity(a, b):
    return SequenceMatcher(None, a, b).ratio()

def extract_bank_accounts(text):
    return re.findall(r"\b\d{8,16}\b", text)

def score_email(sender_domain, subject, body):
    score = 0
    reasons = []

    if sender_domain not in APPROVED_DOMAINS:
        near_match = max([similarity(sender_domain, d) for d in APPROVED_DOMAINS], default=0)
        if near_match > 0.8:
            score += 40
            reasons.append("Sender domain is very similar to a real supplier domain")
        else:
            score += 25
            reasons.append("Sender domain is not approved")

    content = (subject + " " + body).lower()
    for keyword in RISK_KEYWORDS:
        if keyword in content:
            score += 20
            reasons.append(f"Risk keyword found: {keyword}")

    accounts = extract_bank_accounts(body)
    approved_accounts = APPROVED_BANK_ACCOUNTS.get(sender_domain, [])
    for acc in accounts:
        if acc not in approved_accounts:
            score += 35
            reasons.append(f"Unknown bank account: {acc}")

    return {"risk_score": min(score, 100), "reasons": reasons}

result = score_email(
    sender_domain="supp1ier-a.com",
    subject="Updated beneficiary bank account",
    body="Please make today’s payment to account 9988776655."
)
print(result)