Brand impersonation: SoFi

type.inbound
// standard brand template
and (
  // disclaimer
  (
    regex.icontains(body.current_thread.text,
                    '\bsofi (?:bank|invest|securities|team|tech|wealth)\b'
    )
    and regex.icontains(body.current_thread.text,
                        '©.20[0-9]{2}.(?:sofi|social finance)'
    )
    // phone numbers
    and regex.icontains(body.current_thread.text,
                        '\(855\)[\s\-\.]456[\s\-\.]7634',
                        '\(844\)[\s\-\.]908[\s\-\.]7634'
    )
  )

  // address
  or (
    regex.icontains(body.current_thread.text, '\bsofi\b')
    and strings.icontains(body.current_thread.text, "2750 E Cottonwood Pkwy")
    and strings.icontains(body.current_thread.text, "Salt Lake City, UT 84121")
  )

  // observed cred theft ttp
  or (
    regex.icontains(sender.display_name, '\bsofi\b')
    and strings.icontains(body.current_thread.text,
                          "trade confirmation",
                          "self-directed investing account"
    )
  )
)

// negate legitimate replies
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)

// topic negations
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Newsletters and Digests")
)

// negate sofi & related domains
and not (
  sender.email.domain.root_domain in (
    "sofi.com", // parent domain
    "sofi.org", // observed sender domain
    "samsung.com", // financial partnership
    "investordelivery.com" // financials delivery platform
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

// negate high trust sender root domains unless they fail authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)