I would like to rewrite the subject line of all emails that contain a Reply-To: line with an email address in a different domain than the From: line. The reason for this is that I frequently get fraud emails that look like this:
From: My Name <firstname.lastname@example.org> To: email@example.com Reply-To: firstname.lastname@example.org Subject: Please urgently pay attached invoice ...
Outlook displays the "From: " information, which can easily be forged, but does not display the Reply-To: line per default. So the email does not look suspicious. If one replies the email is sent to email@example.com, and the thief will of course make sure that the From: My Name header is again showed in the response. Some of these emails are so cleverly designed that people fall for it.
To prevent this, I would like to rewrite the Subject line to something like "[Potential fraud] Please urgently pay this invoice" if there is a Reply-To recipient which is in a different domain than the From sender.
How do I configure Exim to do this? Please advise.