Business Email Compromise (BEC) with request for mobile number

type.inbound
and (
  length(body.current_thread.text) < 500
  or any(map(filter(ml.nlu_classifier(body.current_thread.text).entities,
                    .name == "disclaimer"
             ),
             .text
         ),
         (length(body.current_thread.text) - length(.)) < 500
  )
)
and length(filter(attachments, .file_type not in $file_types_images)) == 0
and regex.icontains(body.current_thread.text,
                    '(?:mobile
| contact
| current
| reliable
| latest).{0,10}(?:phone
| number
| #
| \bno)
| whatsapp
| \bcell
| personalcell
| (?:share
| what).{0,25}number.{0,15}(?:connect
| reach
| text
| message
| contact
| call)
| (?:\bdrop
| which
| send.{0,5}your
| best).{0,25}(?:number
| \bnum\b
| #).{0,15}(?:(?:connect
| reach
| contact
| call).{0,5}you
| text
| message
| works?\b
| stay connected
| hit you up)
| forward.{0,25}(?:\bnum\b
| #)
| get (?:your.{0,25}(?:number
| \bnum\b
| #)
| in touch.{0,15}(?:via
| by
| through).{0,10}(?:text
| phone
| cell
| sms
| whatsapp))
| (?:provide
| confirm
| reply.{0,15}with).{0,25}(?:direct
| preferred
| personal).{0,15}(?:text.?enabled.{0,15})?(?:phone.{0,5})?(?:number
| \bnum\b
| #
| line)
| (?:share
| send).{0,25}(?:direct
| preferred).{0,15}(?:text.?enabled.{0,15})?(?:phone.{0,5})(?:number
| \bnum\b
| #
| line)
| (?:share
| send).{0,25}preferred.{0,15}(?:text.?enabled.{0,15})?(?:number
| \bnum\b
| #
| line)
| (?:share
| send
| provide).{0,25}preferred.{0,25}(?:contact
| communication).{0,15}(?:method
| info
| means
| way)
| (?:direct
| preferred).{0,15}line.{0,15}(?:for
| to
| via).{0,10}(?:text
| call
| reach
| contact
| sms)
| have.{0,15}preferred.{0,10}number
| (?:share
| send
| provide).{0,25}way.{0,25}(?:reach
| contact).{0,25}(?:call
| text
| sms
| whatsapp)
| (?:reply
| respond).{0,20}with.{0,15}(?:your\s)?(?:phone
| cell
| mobile).{0,5}(?:number
| \bnum\b
| #)'
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ("bec", "advance_fee") and .confidence != "low"
  )
  or (
    // confidence can be low on very short bodies
    length(body.current_thread.text) < 550
    and (
      any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")
      or any(ml.nlu_classifier(sender.display_name).intents, .name == "bec")
      or any(ml.nlu_classifier(body.current_thread.text).entities,
             strings.icontains(.text, "kindly")
      )
    )
  )
)
and (
  (
    (length(headers.references) > 0 or headers.in_reply_to is null)
    and not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "RES:")
        or strings.istarts_with(subject.subject, "R:")
        or strings.istarts_with(subject.subject, "ODG:")
        or strings.istarts_with(subject.subject, "答复:")
        or strings.istarts_with(subject.subject, "AW:")
        or strings.istarts_with(subject.subject, "TR:")
        or strings.istarts_with(subject.subject, "FWD:")
        or regex.imatch(subject.subject,
                        '(\[[^\]]+\]\s?){0,3}(re
| fwd?
| automat.*)\s?:.*'
        )
      )
    )
  )
  or length(headers.references) == 0
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign