diff --git a/session-logs/2026-07/2026-07-21-howard-cascades-phishing-reply.md b/session-logs/2026-07/2026-07-21-howard-cascades-phishing-reply.md
new file mode 100644
index 00000000..9b6d831e
--- /dev/null
+++ b/session-logs/2026-07/2026-07-21-howard-cascades-phishing-reply.md
@@ -0,0 +1,31 @@
+# Session Log: Cascades Phishing Email Reply
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Howard requested a check of recent email from Chris Knight (accounting@cascadestucson.com) sent to howard@azcomputerguru.com. Used the /mailbox skill with Graph API to search Howard's mailbox for messages from that sender.
+
+The most recent email (2026-07-21 13:45 MST) was a forwarded phishing attempt -- Chris forwarded a message from "Meredith Kuhn" at noreply@homelandls.us that impersonated Cascades' Executive Director and requested AR/AP aging reports. This is a classic business email compromise (BEC) pattern targeting financial data.
+
+Howard confirmed a reply should be sent. Drafted guidance advising Chris to delete obviously suspicious emails, forward uncertain ones to Howard for review, and avoid clicking links or opening attachments in unexpected messages. Reply sent successfully via Graph API (HTTP 202) from howard@azcomputerguru.com to accounting@cascadestucson.com.
+
+## Key Decisions
+
+- Identified the email as a BEC/phishing attempt based on the non-Cascades sender domain (homelandls.us) and the financial data request (AR/AP aging reports).
+- Advised Chris to use a two-tier approach: delete obvious phishing, forward uncertain items to Howard.
+
+## Commands & Outputs
+
+- Graph API search: `GET /users/howard@azcomputerguru.com/messages?$search="from:accounting@cascadestucson.com"` -- returned 5 messages, most recent from today.
+- Graph API reply: `POST /users/howard@.../messages/{id}/reply` -- HTTP 202, reply sent successfully.
+
+## Reference Information
+
+- Phishing sender domain: homelandls.us (noreply@homelandls.us)
+- Impersonated identity: Meredith Kuhn, Executive Director, Cascades of Tucson
+- Phishing lure: Request for AR and AP aging reports for all customers and vendors
+- Secondary forwarded layer: Randy Bloxsome via system@sent-via.netsuite.com (order number AE26-MER07-43821-FGL39)