Vendor Email Compromise: The Real Supplier, Fake Invoice

Vendor email compromise (VEC) is fraud where an attacker has actually taken over a supplier's or partner's real email account and uses it to send fraudulent payment instructions to that vendor's customers. Because the message originates from the genuine mailbox, SPF, DKIM, and DMARC checks will often pass — there's no spoofing to catch. Classic business email compromise, by contrast, usually involves a lookalike domain or a spoofed display name impersonating an executive; you can read a full breakdown of that mechanism in our guide on how attackers fake executive emails to trigger wire fraud.

Most phishing defenses look for anomalies in sender authentication, domain age, or reply-to mismatches. VEC has none of those tells. The attacker compromised the vendor's mailbox — often through weak or reused credentials, a hijacked login session, or similar account-takeover methods — and is now operating inside a trusted thread. They may even reply to a real, months-old email chain so the thread looks legitimate. This is part of why strong identity and access controls matter as much for your partners' security posture as your own; weak privileged account hygiene on either side of a vendor relationship is what lets this happen in the first place. If you're evaluating how tightly your own privileged accounts are locked down, our privileged access management services page walks through the controls that make credential takeover much harder.

VEC vs. BEC vs. Adversary-in-the-Middle: Quick Comparison

Notice that the middle column is the problem: in VEC, every technical signal you'd normally check comes back clean. That's exactly why this has to be solved with process, not just with email security tooling.

If there's a single habit that defeats vendor email compromise, it's this: never change payment details based on an email alone, no matter how legitimate it looks. Call the vendor back using a phone number you already had on file — not one in the email — and confirm the change verbally with a known contact. This sounds basic, and it is, but it's the control that gets skipped under deadline pressure, especially at month-end close.

• Require a callback to a verified, previously-documented phone number for any change to bank account, routing number, or remittance address.
• Flag and hold any invoice where payment details differ from the vendor's last three transactions, even if the amount and invoice number look right.
• Set a dollar threshold above which a second approver must independently confirm the change — not just rubber-stamp the first approver's work.
• Keep a vendor contact log that's separate from email, so nobody has to trust the contact info sitting in the suspicious message itself.

Most of what stops VEC isn't a new piece of software — it's process discipline inside AP. A few things worth reviewing:

• Segregate duties so the person who updates vendor banking records isn't the same person who approves payment runs.
• Consider requiring a brief waiting period between a banking-detail change request and the first payment sent under the new details.
• Audit vendor master file changes monthly, looking specifically for recent edits to payment fields.
• Train AP staff that "the email came from the right address" is no longer proof of legitimacy — it's necessary but not sufficient.

If your organization handles protected health information or falls under FTC jurisdiction for financial data, these practices may also be relevant to broader compliance obligations worth reviewing with legal counsel. Review how payment and vendor-data controls fit into your broader obligations under HIPAA safeguards or the FTC Safeguards Rule if those frameworks apply to your business.

You can't control a supplier's email security, but you can set expectations. Ask new and existing vendors:

• Do you require multi-factor authentication on the email accounts that send invoices?
• Who internally is authorized to request a banking-detail change, and can we get that name and direct phone number now?
• Will you confirm in writing that you'll never change payment instructions over email without a verbal follow-up?
• Have you had any recent account compromise incidents that we should know about?

None of these questions are accusatory — they're standard due diligence, and a vendor who bristles at them is telling you something.

Email account takeover — whether it happens to you or to a vendor — almost always traces back to weak authentication, reused passwords, or a missing conditional access policy. Tightening mailbox security across your organization, enforcing modern authentication, and monitoring sign-in anomalies are core parts of a managed Microsoft 365 environment done right. Pair that with broader cybersecurity services that include email authentication monitoring, and with day-to-day oversight from a managed IT services partner who's watching your environment, and VEC becomes a lot harder to exploit — even when the fraud starts on someone else's end.

LayerLogix has spent 20+ years helping Texas businesses close exactly these kinds of process and technical gaps, and we provide 100% Texas-based support with business-hours support and after-hours emergency response when something urgent comes up.

What is vendor email compromise?

Vendor email compromise is fraud where an attacker has gained control of a real supplier's email account and uses it to send legitimate-looking but fraudulent payment instructions, usually a change to banking details on an upcoming invoice.

How is vendor email compromise different from business email compromise?

Business email compromise typically relies on a spoofed or lookalike domain impersonating someone inside or outside your company. Vendor email compromise uses the vendor's actual, hijacked mailbox, so email authentication checks like SPF and DKIM pass normally, making it much harder to detect with technical filters alone.

Can email security tools detect vendor email compromise?

Standard email filters struggle with VEC because the message is technically legitimate — it comes from a real account with valid authentication. Detection depends more on process controls, like verifying payment changes out of band, than on filtering technology alone.

What's the fastest way to verify a payment change request is legitimate?

Call the vendor using a phone number you already have on file — not a number listed in the email — and confirm the change verbally with a known contact before updating any banking details.

Should small businesses worry about vendor email compromise?

Yes. Any business that pays suppliers by invoice is a potential target, regardless of size, since the attacker is exploiting the vendor's compromised account rather than specifically targeting your company's defenses.

If you want a clear picture of where your email security, vendor controls, and AP processes stand today, start with a free IT assessment or contact our team to talk through your specific environment.