VIP impersonation: Invoice fraud with mobile device sign-off

type.inbound
and any(map(filter(body.previous_threads,
                   any($org_vips,
                       strings.icontains(..sender.display_name, .display_name)
                       or (
                         .email != ""
                         and strings.icontains(..sender.email.email, .email)
                       )
                   )
                   and (
                     strings.iends_with(.text, "sent from my iphone.")
                     or strings.iends_with(.text, "sent from my ipad.")
                   )
                   and (
                     // any previous thread authored by the "VIP" has invoice/payment
                     any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                         .name in ("invoice", "payment")
                         and .confidence != "low"
                     )
                     or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                            .name in (
                              "Request to View Invoice",
                              "Payment Information"
                            )
                            and .confidence != "low"
                     )

                     // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
                     or any(attachments,
                            strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
                     )
                   )
            ),
            .sender.email.email
        ),
        . == ""
        or (
          not strings.icontains(sender.email.email, .)
          and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                      strings.icontains(.email.email, ..)
          )
        )
)