Vendor email compromise (VEC) is a fraud where criminals take over a supplier’s real email account and use it to send fraudulent invoices or bank detail change requests to the supplier’s customers. Because the email comes from a genuine address and an existing thread, it gets past most red flags. Only independently checking the bank details stops it.
It’s one of the hardest frauds for finance teams to spot. The email doesn’t come from a lookalike domain or a stranger. It comes from a supplier you’ve worked with for years, in a thread you recognise, with a signature and an invoice that look exactly right. Business email compromise caused over $3 billion in reported losses in the US in 2025, from nearly 25,000 complaints, according to the FBI’s 2025 Internet Crime Report. Requests that appear to come from suppliers are among the costliest.
This guide explains how a supplier email hack unfolds, why the usual controls fail, which warning signs still work, and how to build a process that catches it before the money leaves.
Key takeaways
- In vendor email compromise, the fraudster uses the supplier’s real inbox, so domain checks, email security filters and “does this look right?” reviews often don’t catch it.
- The highest-risk moment is any request to change bank details, especially one that arrives mid-thread.
- Callbacks fail if you dial the number in the email signature, or if the supplier’s contact details were changed first.
- Confirmation of Payee and Verification of Payee checks can be bypassed when fraudsters open accounts in names close to the supplier’s.
- The control that works is independently checking that the new account belongs to the supplier, combined with a documented callback to a trusted number.
- If you’ve already paid, call your bank within hours. Recovery chances fall sharply after the first 24 to 72 hours.
What is vendor email compromise, and how is it different from spoofing?
Vendor email compromise is a form of business email compromise in which the attacker gains access to a supplier’s genuine email account, usually through phishing or stolen passwords. From there, they can read past invoices, learn payment cycles and reply inside real threads.
That makes it very different from other email-based frauds:
| Type of fraud | What your team sees | What usually catches it |
|---|---|---|
| Spoofed email (forged sender address) | An address that looks right but wasn’t sent by the supplier | Email authentication (SPF, DKIM, DMARC) and security filters |
| Lookalike domain | A domain that differs by one character, or a different extension (.co instead of .com) | Careful review, domain monitoring |
| Hacked supplier inbox (VEC) | The supplier’s real address, in a real thread, with the right signature | Only independent verification of the bank details |
With spoofing and lookalike domains, there’s something wrong with the email. With vendor email compromise, the email itself is genuine. Only the bank details are fake. Learn more about how email spoofing works.
How a supplier email hack unfolds
Vendor email compromise is rarely a one-off message. It’s usually a patient, well-researched attack:
| Stage | What the fraudster does | What your finance team sees |
|---|---|---|
| Weeks before | Takes over the supplier’s inbox, reads past emails, studies invoice formats, payment dates and contacts | Nothing |
| The set-up | Sets up hidden mailbox rules to divert or delete replies from your company | Normal correspondence with the supplier |
| The request | Replies in an existing thread: “We’ve changed banks, please use the new details for the next payment” | A familiar contact, a real thread, a plausible reason |
| The payment | Waits for the next payment run | A routine payment |
| The exit | Moves the funds through mule accounts within hours | Nothing |
| Weeks later | — | The real supplier chases an unpaid invoice |
Finance teams describe the same pattern again and again. One manufacturer told us that a fraudster used a supplier’s hacked email to request new bank details, and the payment was released before anyone noticed. Another company sent around $60,000 to fraudulent accounts after a supplier’s email was compromised. In both cases, the request looked completely normal.
Why the usual red flags and controls don’t work
Most fraud awareness training teaches teams to spot suspicious emails. With vendor email compromise, there’s often nothing suspicious to spot:
- The domain is real. The email passes authentication checks because it really was sent from the supplier’s account.
- The thread is real. The request arrives as a reply to a genuine conversation about a genuine invoice.
- The invoice matches. Amounts, purchase order numbers and formatting are copied from previous invoices.
- The callback reaches the fraudster. If your team calls the number in the email signature, or a number the fraudster has already changed in your supplier records, the fraudster answers and “confirms” the change. See when callbacks fail.
- Name checks can be fooled. Fraudsters sometimes open accounts in names close to the supplier’s, so a bank name-check service may return a “close match” that looks like a typo.
- The real supplier goes quiet. Hidden mailbox rules can delete your messages before the real supplier sees them, so nobody raises the alarm.
That’s why manual review alone isn’t enough. 48% of companies still rely on manual fraud prevention methods, according to Trustpair’s 2026 Fraud Report, and these are exactly the controls vendor email compromise is designed to beat.
Warning signs that still work
Even when the email looks perfect, some signals remain. Train your team to treat these as triggers for verification, not as proof:
- A bank detail change in the middle of an ongoing thread, especially just before a payment is due.
- A new bank or a new country for the account, particularly if it doesn’t match where the supplier operates.
- A recent change to the supplier’s contact details (phone number, email, contact person) in your records, followed by a bank change.
- A request to reply only by email, or a reason why the supplier “can’t take calls right now.”
- A different account holder name from the supplier’s legal entity name.
- Unusual urgency or a change in tone, such as “overdue” pressure on an invoice that isn’t late.
- The supplier going quiet on other topics, or responses arriving at unusual hours.
For a broader list, see the most common red flags for fraud.
What to do when you receive a bank detail change request
Treat every bank detail change request as a potential fraud until it’s independently verified, no matter how familiar the sender. A six-step process:
- Pause. Don’t update the supplier record or release any payment to the new account until verification is complete. Urgency is not a reason to skip a step.
- Call back on a trusted number. Use a number from your approved supplier records or the supplier’s official website, never one from the email, signature or invoice. Ask the supplier to state the change they requested rather than confirming the details you read out. Follow a documented call back procedure.
- Check who owns the account. Use automated account validation to confirm that the new bank account belongs to the supplier’s legal entity, independently of anything the supplier or the email says.
- Apply the four-eyes principle. The person who verifies the change should be different from the person who requested or enters it, and someone who can change a supplier record should not be able to release payments to it alone.
- Record what you did. Write down the number called, the person reached, what was confirmed and the outcome, so the control can be shown to auditors. In the US, Nacha’s 2026 rules expect businesses sending ACH payments to have documented, risk-based processes to detect fraud such as business email compromise.
- Watch the account after the change. Fraudsters sometimes change details again or test with a small payment first. Continuous vendor master data monitoring flags further changes automatically.
If you pay by wire, see also our guide on how to verify wire instructions.
What to do if you’ve already paid
Speed matters more than anything else. Funds sent to mule accounts are usually moved within hours.
- Call your bank’s fraud team immediately, using a number you look up independently, and ask for a recall of the payment.
- File a complaint with the FBI’s IC3 at ic3.gov the same day. Quick reporting can help freeze funds.
- Warn your supplier through a verified channel (phone, not email). Their inbox is compromised, and other customers may also be targeted.
- Keep the evidence. Save the original emails with full headers (don’t just forward them), invoices, payment confirmations and a timeline.
- Notify your insurer if you have cyber or crime cover.
- Stop further payments to any account changed recently, and check whether other suppliers’ details were changed.
For a complete step-by-step response, follow our 7-step playbook for responding to an impersonation scam and our guide to wire transfer fraud prevention and recovery.
Who bears the loss?
There’s no single answer. Whether the loss falls on your company or the supplier usually depends on your contract, the applicable law and whether each party followed reasonable security practices. In practice, these cases often lead to difficult disputes: the supplier is still owed the money, and your company may have to pay twice.
The safest position is to show that you followed a documented, consistent verification process before paying. Ask your legal team to review how your contracts and supplier terms cover changes to payment instructions.
How to build a control that catches compromised supplier emails
Because vendor email compromise defeats email-based checks, the answer is to verify the bank account, not the email, at every stage where bank details can change:
- At onboarding: confirm that the supplier is a legitimate company and that the bank account belongs to it.
- At every change: trigger a new verification for every change to bank or contact details, combining automated validation with a callback when the risk calls for it.
- Continuously: monitor your supplier master data for unexpected changes, including changes made directly in your ERP.
- Before payment: check payment files against verified bank data before each payment run is released.
This is how Trustpair works. Trustpair automatically checks that each supplier bank account belongs to the right company, at onboarding, at every change and before each payment. When a phone conversation is needed, Trustpair agents carry out callback verification using trusted contact information, and every check is documented. A fraudster can control a supplier’s inbox, but they can’t make a fraudulent account belong to your supplier.
Learn more about Trustpair’s approach to vendor fraud prevention.
Talk to a fraud expert about protecting your supplier payments
You might also like: What Are Call Back Procedures? · Examples of Business Email Compromise · How to Respond to a Company Impersonation Scam