Instructed to investigate a case involving a suspected man in the middle (MITM) attack where communications between two parties were intercepted and the bank details on an invoice altered. Email headers in the email HTML were analysed, including sender, recipient and various authentication details, using our forensic review platform Intella Connect. The investigation concluded which of the parties’ accounts had been compromised.