Imagine your accounts-payable team receives an email from a supplier you have worked with for years. The invoice number is correct. The amount matches the purchase order. The email is part of an existing conversation.
Then the supplier says its bank account has changed and asks you to use the new details for the next payment.
Nothing looks obviously wrong. But the bank account belongs to a criminal.
That is the basic idea behind Vendor Email Compromise (VEC). Instead of sending a random phishing email, attackers abuse a trusted business relationship and use it to redirect a payment.
What is Vendor Email Compromise?
Vendor Email Compromise is a type of business email fraud in which an attacker impersonates or compromises a trusted vendor or supplier and uses that relationship to trick a customer into making a fraudulent payment or changing sensitive business information.
The attacker may take control of a real vendor mailbox, use a lookalike domain, or impersonate a person involved in the supplier relationship. The exact method can vary, but the goal is usually the same: make a payment request look like normal business activity.
VEC is closely related to Business Email Compromise (BEC), but the focus is different. BEC is a broader category covering many types of payment and data theft scams. VEC specifically abuses the trust between a business and its vendors or suppliers.
How a VEC attack works
There is no single VEC attack pattern. A criminal does not always need to compromise the vendor’s email account. In some cases, a lookalike address or another form of impersonation is enough.
A typical attack can look like this:
- The attacker learns about the relationship. They identify a supplier, customer, employee, invoice process, or upcoming payment. Some information may be publicly available, while other details can come from a compromised mailbox.
- The vendor account or identity is compromised or imitated. The attacker may steal credentials through phishing, reuse exposed credentials, or register an address that looks similar to the real vendor’s domain.
- The attacker watches the conversation. If they have access to a mailbox, they can look for invoices, purchase orders, payment dates, signatures, and the people responsible for approving payments.
- A believable request is sent. The message may say that the vendor has changed banks, updated its payment instructions, changed its billing process, or needs an urgent payment.
- The payment is redirected. If the new account details are accepted without independent verification, the money can be sent to an account controlled by the attacker.
Real-world investigations have shown attackers monitoring supplier communications and joining existing invoice conversations rather than starting from scratch. That makes the fraudulent message much harder to dismiss as ordinary spam.
Why VEC emails can be difficult to spot
The biggest problem with VEC is that the message may contain information that is genuinely correct.
The vendor may be real. The invoice may be real. The amount may be real. The email thread may be real.
The part that has been changed is where the payment should go.
For example, suppose a company normally pays a supplier $25,000 every month. An attacker gets access to the supplier’s mailbox and waits until an invoice is being discussed. The attacker then replies in the same conversation and says:
“We have moved our banking relationship. Please use the account shown on the attached document for this payment and all future invoices.”
There may be no malicious attachment, no obvious spelling mistake, and no suspicious link. If the employee only checks whether the invoice itself is legitimate, the fraud can be missed.
VEC vs BEC vs phishing
| Attack | What the attacker is trying to do |
|---|---|
| Phishing | Trick someone into clicking, signing in, opening a file, or revealing information. |
| BEC | Impersonate or compromise a trusted person or organization to cause a fraudulent payment or obtain sensitive information. |
| VEC | Abuse a trusted vendor or supplier relationship, often to redirect an invoice or other legitimate payment. |
These categories can overlap. For example, phishing may be the way an attacker first obtains access to a vendor’s mailbox, after which that account is used for a VEC attack.
Warning signs of a vendor payment scam
A single warning sign does not prove that an email is fraudulent. The important thing is to pay attention when several unusual details appear together.
- A vendor suddenly asks you to change its bank account or payment instructions.
- The request is marked urgent or says the change must be made before a deadline.
- The sender asks you to keep the change confidential or avoid calling the usual contact.
- The sender’s domain is slightly different from the vendor’s normal domain.
- The request arrives at an unusual point in the normal billing cycle.
- The payment details in the new invoice do not match the vendor information already stored in your system.
- A familiar email conversation suddenly contains a new sender, reply-to address, or unusual attachment.
- A supplier asks you to confirm payment to a new account without using the normal change-control process.
The FBI specifically advises businesses to verify changes in account numbers or payment procedures with the person making the request and to use a separate communication method when appropriate.
The most important control: verify payment changes separately
Do not treat a bank-account change as an ordinary email request.
If a supplier asks for new payment details, stop the payment and contact the supplier using a phone number or other contact information that you already have in your records. Do not use a phone number included in the suspicious email.
This matters because replying to the same compromised email account does not actually verify anything. If the attacker controls the mailbox, they can simply confirm their own fraudulent request.
For larger payments, businesses should consider requiring a second employee to approve the change and the payment. The exact approval threshold can depend on the organization’s size, risk and financial processes.
Technical controls that can help
Use MFA for business email
Multi-factor authentication can make it harder for attackers to take over employee accounts using stolen passwords. It does not replace payment verification, but it is an important layer of protection.
Protect email domains with SPF, DKIM and DMARC
SPF, DKIM and DMARC help organizations authenticate mail sent from their domains and can reduce some forms of domain spoofing. They are useful controls, but they do not solve every VEC problem.
If a criminal has taken over a legitimate vendor mailbox, an email can still come from the real domain. That is why organizations should combine email authentication with account security, monitoring and payment controls.
Monitor mailbox activity
Organizations should look for unusual sign-ins, suspicious inbox rules, unexpected forwarding settings and other changes that could indicate an account takeover. These controls are particularly important for employees who manage supplier relationships or financial information.
Protect the vendor master record
Changing a supplier’s bank details should require more than an email. Limit who can make changes, record who made them, and require an independent verification step before the new details are used for payment.
What if the payment has already been sent?
Act immediately. Do not wait for the vendor to confirm that something is wrong.
Contact your bank or payment provider and ask what options are available to recall or stop the transaction. Preserve the original emails, headers, invoices, payment records, account details, phone numbers and other evidence.
For organizations affected by BEC in the United States, the FBI recommends reporting the incident to the Internet Crime Complaint Center (IC3) as soon as possible. IC3 says rapid reporting can help financial institutions and law enforcement when attempting to freeze or recover funds, although recovery is not guaranteed.
Organizations outside the United States should also report the incident to the appropriate national cybercrime authority and financial institution.
What recent data tells us about BEC
Vendor Email Compromise is not separately listed as a headline crime category in the FBI’s 2025 IC3 summary. It sits within the wider business email compromise landscape.
The FBI’s 2025 IC3 data recorded about $3 billion in reported losses from Business Email Compromise. That figure should not be interpreted as VEC losses alone; it covers BEC as a broader category.
The numbers also represent reported complaints, so they do not capture every incident. Some businesses may not report fraud at all.
What makes VEC different from a normal fake invoice?
A fake invoice usually starts with the invoice itself. VEC can be much harder to spot because the attacker may enter an existing business relationship and wait for a legitimate payment to appear.
That difference changes how the defense should work.
Instead of asking only, “Does this invoice look real?” the accounts-payable team should also ask:
- Did the vendor actually request this change?
- Was the request made through the normal process?
- Has the bank-account change been independently verified?
- Does the new account match the information already held in our vendor records?
- Is there any reason this payment needs to be made differently from previous payments?
That small change in thinking is important. The invoice can be genuine while the payment instructions are fraudulent.
Bottom line
VEC works because businesses naturally trust the vendors they deal with every day. Attackers try to turn that trust into a payment opportunity.
The most useful defense is not a single security product. It is a process that makes payment changes difficult to approve based on email alone.
Use MFA and secure business email accounts. Protect your domain with appropriate email authentication. Monitor for account compromise. Most importantly, independently verify any change to a vendor’s bank details before sending money.
If an email asks you to change where a payment is going, slow down. A short verification call can be far less expensive than discovering later that a legitimate invoice was paid to a criminal.
