What happened: You hit Reply and wrote: "Lucia — can you confirm this is urgent? Want to make sure we get this through treasury." Within 3 minutes, you received a reply:
"Yes — please process it now. I'm unavailable for a call. The 2pm deadline is real and I can't have this delayed. Thanks."
The writing style matched Lucia's terse, direct communication. You were now more confident. You processed the wire at 12:47pm. By 2:30pm, the real Lucia called you in a panic — she'd been in meetings all day, had no idea about any wire, and her email account showed no sent messages matching that thread.
// WHAT WENT WRONG
• Replying confirmed your email address is active and monitored
• The attacker's auto-reply system generated a convincing response
• Your confirmation bias increased — "they replied, so it's real"
• The Reply-To address was controlled by the attacker throughout
• The verification happened on the attacker's channel, not an independent one
Correct action: Never verify via the same channel that delivered the request. The Reply-To address was controlled by the attacker. You should have called Lucia's known number directly — not from the email, not from the reply — from your saved CRM contact.