I couldn’t figure out why US Bank business card applications using a sole proprietorship EIN kept disappearing into a black hole or being denied. Eventually after a few phone calls they complained about the email address.
The other was ferguson.com, so that I could order specialized furnace parts and larger diameter plumbing fittings than I could order from Home Depot. I don’t remember the details, but I think the Ferguson business application kept trying to autofill an address for me. It probably would have required a confirmation from the person who had been turned into the administrator of “fastmail” before I could have been added to their organization and been able to make purchases using their account.
It might not be a problem at larger suppliers like Grainger or Digikey, but it does suggest a vulnerability if you set up a corporate account at a small supplier using a fastmail address. Their backend could assume that anyone able to receive emails on “your” fastmail.com domain is at least authorized by your IT department to use email. If they assume your IT department has an email retention policy, then they might default to treating it like your problem if one of your employees makes an unauthorized purchase.
Not only that, I used to use businessname@mydomain.com for setting up aliases to interact with different businesses. On more than a few occasions I had some very confusing back and forth until realising the issue, when they asked which department I was from.
When they saw their own business name in the email address they just straight up assume I am part of their company. No wonder phishing works.
The other was ferguson.com, so that I could order specialized furnace parts and larger diameter plumbing fittings than I could order from Home Depot. I don’t remember the details, but I think the Ferguson business application kept trying to autofill an address for me. It probably would have required a confirmation from the person who had been turned into the administrator of “fastmail” before I could have been added to their organization and been able to make purchases using their account.
It might not be a problem at larger suppliers like Grainger or Digikey, but it does suggest a vulnerability if you set up a corporate account at a small supplier using a fastmail address. Their backend could assume that anyone able to receive emails on “your” fastmail.com domain is at least authorized by your IT department to use email. If they assume your IT department has an email retention policy, then they might default to treating it like your problem if one of your employees makes an unauthorized purchase.