Vendor email compromise: when the invoice really comes from your supplier

Most advice about invoice fraud assumes the attacker is outside, writing from a lookalike domain. Vendor email compromise is the version where they are inside: they have taken over a mailbox at one of your real suppliers, read months of correspondence, and reply in an existing thread about a real invoice - asking you to pay it to a different account.

It is the most convincing form of business email compromise, because almost every detail is genuine: the person, the address, the thread, the invoice number, the amount. Only the bank details are not.

SPF, DKIM and DMARC answer one question: did this message really come from the domain it claims? Here the answer is yes. The message was sent from the supplier's real mailbox, through their real mail provider, signed with their real key.

Attackers usually get in the same way they get into anyone's mailbox: a phished password on an account without multi-factor authentication. Once in, they often add an inbox rule that moves replies from you into a hidden folder, so the real supplier never sees the conversation.

A composite example. Names and domains are fictional.

The third message is from the real address, in the real thread, about the real invoice. The tells are all in the behaviour: a bank change, an explanation nobody asked for, a request to confirm in writing, and a send time far outside the supplier's normal hours.

• Any change of bank details, at any point, by email. This alone is enough to stop and verify.
• A reason for the change that sounds official - an audit, a new bank, a closed account, a tax issue.
• A request to reply by email rather than the usual process, or to keep it quiet "until it's sorted".
• Sent at an odd hour for that person, or from a new time zone.
• A Reply-To that differs from the From address, or a new person copied in from an unfamiliar domain.
• An attached "letter" on letterhead with new account details, when invoices normally carry them.
• Urgency attached to an invoice that was previously relaxed ("net 30 as usual").

None of these depend on spotting the email. They make a successful one fail anyway.

1. 1Bank details are changed only through a written process, never from an email alone.
2. 2Every change is confirmed by phone on a number from your own records, or from a contract - never from the message, its signature, or the attached letter.
3. 3New details are held for a short period (for example 48 hours) before first use, with the supplier contact told about the change on a known channel.
4. 4A second person approves the first payment to any new account.
5. 5Where your bank offers it, use payee verification or confirmation-of-payee checks that match the account name to the supplier.

What to keep on file for every supplier

Who should know this rule

Everyone who can pay an invoice or edit supplier records - including the owner, who is the person most likely to bypass the process “just this once”.

Verification works best when both sides expect it. A short note to your regular suppliers - sent once, and repeated in onboarding for new ones - turns an awkward phone call into a routine step:

The second half matters as much as the first. Attackers inside your own mailbox can send fake bank-change requests to your customers, and a customer who knows you always call is far less likely to pay.

Signs a supplier has been compromised

• Several of their customers receive bank-change requests in the same week.
• Replies to their address bounce or go unanswered while "they" keep pushing a payment.
• Their real contact, reached by phone, has not seen your emails.

1. 1Reset the affected account's password and sign out every session.
2. 2Turn on multi-factor authentication for that account and every other mailbox in the company.
3. 3Look for inbox rules that forward mail outside or move messages to rarely opened folders, and delete them.
4. 4Check for external forwarding addresses and connected third-party apps the person did not add.
5. 5Tell your customers on a known channel - phone, not email - that any bank-change request in the past weeks was not from you.

Reporting quickly matters for everyone involved. In the US, victims who paid should file at ic3.gov and call their bank's fraud line the same day.