Supplier email compromise is a fraud where criminals take over a supplier’s real email account and use it to send fraudulent invoices or bank detail change requests to the supplier’s customers. Because the email comes from a genuine address and an existing thread, it gets past most red flags. Only independently checking the bank details stops it.
It’s one of the hardest frauds for finance teams to spot. The email doesn’t come from a lookalike domain or a stranger. It comes from a supplier you’ve worked with for years, in a thread you recognise, with a signature and an invoice that look exactly right. UK Finance reported that criminals stole £1.28 billion through payment fraud in 2025, including £75.6 million in business losses from authorised push payment fraud. Read the UK Finance Annual Fraud Report 2026.
This guide explains how a supplier email hack unfolds, why the usual controls fail, which warning signs still work, and how to build a process that catches it before the money leaves. Trustpair’s UK vendor fraud prevention platform helps organisations validate supplier bank accounts throughout the payment process.
Key Takeaways
- In supplier email compromise, the fraudster uses the supplier’s real inbox, so domain checks, email security filters and “does this look right?” reviews often don’t catch it.
- The highest-risk moment is any request to change bank details, especially one that arrives mid-thread.
- Callbacks fail if you dial the number in the email signature, or if the supplier’s contact details were changed first.
- Confirmation of Payee checks can return a match or close match, but they do not prove that the supplier requested the change.
- The control that works is independently checking that the new account belongs to the supplier, combined with a documented callback to a trusted number. If you’ve already paid, call your bank immediately and report the incident.
What Is Supplier Email Compromise, And How Is It Different From Spoofing?
Supplier email compromise is a form of business email compromise in which the attacker gains access to a supplier’s genuine email account, usually through phishing or stolen passwords. From there, they can read past invoices, learn payment cycles and reply inside real threads.
That makes it very different from other email-based frauds:
| Type of fraud | What your team sees | What usually catches it |
|---|---|---|
| Spoofed email (forged sender address) | An address that looks right but wasn’t sent by the supplier | Email authentication, including SPF, DKIM and DMARC, and security filters |
| Lookalike domain | A domain that differs by one character, or a different extension such as .co instead of .com | Careful review and domain monitoring |
| Hacked supplier inbox (supplier email compromise) | The supplier’s real address, in a real thread, with the right signature | Only independent verification of the bank details |
With spoofing and lookalike domains, there’s something wrong with the email. With supplier email compromise, the email itself is genuine. Only the bank details are fake. For a broader overview of supplier fraud, see The Top 3 Vendor Fraud Schemes.
How Does A Supplier Email Hack Unfold?
Supplier email compromise is rarely a one-off message. It’s usually a patient, well-researched attack:
| Stage | What the fraudster does | What your finance team sees |
|---|---|---|
| Weeks before | Takes over the supplier’s inbox, reads past emails, studies invoice formats, payment dates and contacts | Nothing |
| The set-up | Sets up hidden mailbox rules to divert or delete replies from your organisation | Normal correspondence with the supplier |
| The request | Replies in an existing thread: “We’ve changed banks, please use the new details for the next payment” | A familiar contact, a real thread, a plausible reason |
| The payment | Waits for the next payment run | A routine payment |
| The exit | Moves the funds through mule accounts within hours | Nothing |
| Weeks later | — | The real supplier chases an unpaid invoice |
Finance teams describe the same pattern again and again. One manufacturer told us that a fraudster used a supplier’s hacked email to request new bank details, and the payment was released before anyone noticed. Another company sent tens of thousands of pounds to fraudulent accounts after a supplier’s email was compromised. In both cases, the request looked completely normal.
Why Don’t The Usual Red Flags And Controls Work?
Most fraud awareness training teaches teams to spot suspicious emails. With supplier email compromise, there’s often nothing suspicious to spot:
- The domain is real. The email passes authentication checks because it really was sent from the supplier’s account.
- The thread is real. The request arrives as a reply to a genuine conversation about a genuine invoice.
- The invoice matches. Amounts, purchase order numbers and formatting are copied from previous invoices.
- The callback reaches the fraudster. If your team calls the number in the email signature, or a number the fraudster has already changed in your supplier records, the fraudster answers and “confirms” the change. See What Are Call Back Procedures And How Do They Prevent Payment Fraud?.
- Name checks can be fooled. Fraudsters sometimes open accounts in names close to the supplier’s, so Confirmation of Payee may return a close match that appears to be a minor error.
- The real supplier goes quiet. Hidden mailbox rules can delete your messages before the real supplier sees them, so nobody raises the alarm.
That’s why manual review alone isn’t enough. Confirmation of Payee checks the name on a new payee account, alongside the sort code and account number, but it does not prove that the supplier requested the change. The Pay.UK Confirmation of Payee FAQs explain how match, close match and no match results work.
What Warning Signs Still Work?
Even when the email looks perfect, some signals remain. Train your team to treat these as triggers for verification, not as proof:
- A bank detail change in the middle of an ongoing thread, especially just before a payment is due.
- A new bank or a new country for the account, particularly if it doesn’t match where the supplier operates.
- A recent change to the supplier’s contact details, such as a phone number, email address or contact person, followed by a bank change.
- A request to reply only by email, or a reason why the supplier “can’t take calls right now”.
- A different account holder name from the supplier’s legal entity name.
- Unusual urgency or a change in tone, such as “overdue” pressure on an invoice that isn’t late.
- The supplier going quiet on other topics, or responses arriving at unusual hours.
For a broader list, see The Top 3 Vendor Fraud Schemes.
What Should You Do When You Receive A Bank Detail Change Request?
Treat every bank detail change request as a potential fraud until it’s independently verified, no matter how familiar the sender. A six-step process:
Pause
Don’t update the supplier record or release any payment to the new account until verification is complete. Urgency is not a reason to skip a step.
Call Back On A Trusted Number
Use a number from your approved supplier records or the supplier’s official website, never one from the email, signature or invoice. Ask the supplier to state the change they requested rather than confirming the details you read out. Follow a documented callback procedure.
Check Who Owns The Account
Use automated account validation to confirm that the new bank account belongs to the supplier’s legal entity, independently of anything the supplier or the email says.
A sort code checker can confirm whether a sort code is valid and linked to the expected bank, but it cannot prove who owns the account. See The Essential Guide To Sort Code Checkers In UK Banking.
Apply The Four-Eyes Principle
The person who verifies the change should be different from the person who requested or enters it, and someone who can change a supplier record should not be able to release payments to it alone.
Record What You Did
Write down the number called, the person reached, what was confirmed and the outcome, so the control can be shown to auditors. Keep records securely and in line with your organisation’s UK GDPR requirements. See the GOV.UK guidance on UK data protection legislation.
For FCA-regulated firms, documented, risk-based controls also support the management of supplier and third-party risk throughout the relationship.
Watch The Account After The Change
Fraudsters sometimes change details again or test with a small payment first. Continuous vendor master data monitoring flags further changes automatically.
If you pay by bank transfer, also see The Essential Guide To Sort Code Checkers In UK Banking.
What Should You Do If You’ve Already Paid?
Speed matters more than anything else. Funds sent through Faster Payments may move within seconds, while Bacs and CHAPS payments can also become difficult to recover once processed.
- Call your bank’s fraud team immediately, using a number you look up independently, and ask for a recall of the payment.
- Report the incident to Report Fraud if you are based in England, Wales or Northern Ireland. If you are based in Scotland, contact Police Scotland on 101.
- Warn your supplier through a verified channel, such as a phone call rather than email. Their inbox is compromised, and other customers may also be targeted.
- Keep the evidence. Save the original emails with full headers, invoices, payment confirmations and a timeline.
- Notify your insurer if you have cyber or crime cover.
- Stop further payments to any account changed recently, and check whether other suppliers’ details were changed.
The National Cyber Security Centre recommends forwarding suspicious emails to report@phishing.gov.uk. Read the NCSC guidance on reporting scam emails.
Who Bears The Loss?
There’s no single answer. Whether the loss falls on your organisation or the supplier usually depends on your contract, the applicable law, the payment method and whether each party followed reasonable security practices.
In practice, these cases often lead to difficult disputes: the supplier is still owed the money, and your organisation may have to pay twice.
The safest position is to show that you followed a documented, consistent verification process before paying. Ask your legal team to review how your contracts and supplier terms cover changes to payment instructions.
The Payment Systems Regulator’s reimbursement framework has improved outcomes for some victims of in-scope authorised push payment fraud, but businesses should not assume that every supplier fraud loss will qualify for reimbursement. Read the UK Finance Annual Fraud Report 2026 for the latest UK payment fraud data.
How Can You Build A Control That Catches Compromised Supplier Emails?
Because supplier email compromise defeats email-based checks, the answer is to verify the bank account, not the email, at every stage where bank details can change:
At Onboarding
Confirm that the supplier is a legitimate company and that the bank account belongs to it.
At Every Change
Trigger a new verification for every change to bank or contact details, combining automated validation with a callback when the risk calls for it.
Continuously
Monitor your supplier master data for unexpected changes, including changes made directly in your ERP.
Before Payment
Check payment files against verified bank data before each payment run is released.
This is how Trustpair works. Trustpair automatically checks that each supplier bank account belongs to the right company, at onboarding, at every change and before each payment. When a phone conversation is needed, Trustpair agents carry out callback verification using trusted contact information, and every check is documented. A fraudster can control a supplier’s inbox, but they can’t make a fraudulent account belong to your supplier.
Learn more about Trustpair’s approach to vendor fraud prevention.
You might also like: What Are Call Back Procedures And How Do They Prevent Payment Fraud? • How To Detect And Avoid BEC Attacks • Continuous Vendor Master Data Monitoring