The Vendor Fraud Email That Already Knew Your Supplier's Name

The most convincing invoice fraud looks exactly like a normal bill. See how it works and the simple checks that keep the money where it belongs. 

------------------------------------------------------------------------------------------------------------------

TL;DR: Vendor fraud rarely looks like a scam; it looks like a supplier with a new bank account and a reasonable excuse. Attackers piece together who you pay, who approves it, and when the checks go out, sometimes from public sources and sometimes from inside a vendor's hijacked mailbox. Spam filters mostly shrug, since there's no malware to catch and the message may come from a real account. Confirming banking changes through a separate channel stops most of these, and calling the bank fast salvages a surprising share of what slips through. 

------------------------------------------------------------------------------------------------------------------

Most email scams are pretty easy to laugh off. The long-lost prince with an inheritance. The "CEO" who suddenly needs gift cards. The invoice so full of typos that it might as well be signed by a toddler. Vendor fraud isn't that. It looks like regular Monday paperwork; it comes from somebody you already pay, and what it asks for sounds completely sensible.

Think about picking up a prescription. The pharmacist asks for your name and date of birth, you rattle them off, and the bag slides across the counter. That's the whole check. Now think about how many people could answer those two questions about you, starting with anyone who's ever seen a birthday post on social media. Vendor fraud works the same way. There's a check in place; it's just built on details that aren't very hard to get.

And it's not some rare thing. In the Association for Financial Professionals' 2026 payments fraud survey, 74% of organizations said they dealt with business email compromise attempts in 2025. That's more than any other kind of payment fraud, checks included. FinCEN has also noticed that fake vendor invoices tend to be bigger than other email scams, which makes sense. Nobody blinks at a bill they were expecting anyway.

So this isn't really a server room problem. It's an accounts payable problem. Plenty of companies spend good money on email security and still pay a bogus invoice, because the weak spot isn't the software. It's a process that trusts a familiar name.

The good part? Fixing it doesn't take a new gadget. It takes knowing why these emails work so well, plus a few simple habits that take the teeth out of even a very convincing request.

Table of Contents

1. Why a Familiar Name Gets the Invoice Paid
2. What a Vendor Fraud Email Looks Like
3. Why Spam Filters Let It Through
4. When the Request Comes From "the Boss"
5. Habits That Stop the Payment
6. Ask for More Than a Birthday
7. Key Takeaways
8. Frequently Asked Questions

Why a Familiar Name Gets the Invoice Paid

People in accounts payable aren't gullible. They're busy, and their whole job is getting money to the right places on time. When an email shows up from a supplier they've paid fifty times, with a real PO number in the subject line and the same rep's signature at the bottom, nothing about it rings an alarm. A real PO number is basically a hall pass. That's the trick. Vendor fraud doesn't try to look trustworthy; it borrows trust that's already there.

Most of the prep work is reading. Supplier logos on your case studies, a vendor's own "who we work with" page, profiles that say who handles payables, a press release thanking the contractor who built the new warehouse. Put those together and a stranger knows who you pay, who signs off and roughly when. How much of that is sitting out in the open is an eye-opener on its own, and it's the reason these emails sound so convincing.

Then there's timing. Scammers love the month-end close, the week before a holiday, and the last afternoon before checks go out. A request that lands when everybody's rushing gets a lot less attention than one that shows up on a quiet Wednesday morning. Nobody's slacking; they're just doing three things at once.

The result is an email that passes every gut check. Right vendor, right contact, right amount, right timing. The only thing that's off is the bank account at the bottom, and that's the one detail people almost never hold up against last month's invoice.

What a Vendor Fraud Email Looks Like

Picture the typical one. The subject line reads "Updated banking info for Acme Supply," and the note is short and polite. They've switched banks; the old account closes at the end of the month, please use the attached details for any open invoices, and thanks for being such a great customer. Sometimes there's a W-9 attached to make it look official, because nothing says "trust me" like paperwork nobody asked for. It's the kind of email a real supplier sends once or twice a year, which is exactly why it works.

These come in two flavors. The first is impersonation. The sender's address looks right at a glance but is off by a letter, or uses a different ending, like acme-supply.co instead of acmesupply.com. Lookalike domains are a topic all their own, and a later post in this series digs into how they get registered and put to work. The second flavor is nastier. The scammer has gotten into the vendor's real mailbox, so the email comes from the actual address, sometimes as a reply in an existing thread about a real invoice. FinCEN lumps both under the same umbrella, and the AFP survey found that 39% of organizations had received genuine emails that fraudsters intercepted.

The tells are subtle, but they're there. A change to payment details is the big one; that request should make anyone sit up, no matter who sent it. Urgency is another, especially when it comes with a reason you can't call ("I'm traveling all week, email is best"). And keep an eye out for a reply-to address that doesn't match the sender, which most email programs tuck out of sight unless you go looking.

Why Spam Filters Let It Through

Spam filters are good at what they're built for, and that's the problem. They're tuned to catch malicious attachments, sketchy links, mass mailings, and senders with a bad reputation. A vendor fraud email usually has none of that. It's a few polite sentences from a real-looking (or truly real) address, asking a person to type new numbers into a payment system. There's nothing to scan.

When the message comes from a vendor's actual account, it gets even harder. The email passes the authentication checks that confirm it came from the domain it claims, because it did. The vendor's reputation is spotless because, until recently, the vendor was just a vendor. Filters judge the envelope, and the envelope is legitimate. The letter inside is the lie.

Lookalike domains give a filter a little more to work with, but not much. A domain registered last week sometimes gets flagged, and some email platforms show a warning banner for first-time senders. Plenty don't, and plenty of people have learned to click past those banners the same way they click past cookie notices.

That doesn't make email security a waste of money. It blocks an enormous amount of junk that would otherwise land in front of your staff every day. It just means a clean inbox isn't proof that a request is real. The last line of defense on a payment change is a person, and the best thing you can give that person is a process that doesn't depend on spotting a fake.

When the Request Comes From "the Boss"

The vendor isn't the only name worth borrowing. The other classic move is posing as the owner or a senior manager. The email carries the CEO's name, sometimes from a personal-looking address with a "sent from my phone" signature, and the ask is simple. Wire this deposit to a new supplier today, and keep it between us because the deal isn't public yet. FinCEN calls out exactly this pattern, where a fake executive leans on an employee not to question or verify the order.

It works because org charts have gravity. Most people won't push back on the owner, especially over email, and especially when the owner is supposedly on a plane or stuck in meetings. The scammer can piece together the boss's travel plans from social media and the right employee's name from the company website, so both the timing and the target feel right.

The tools have gotten better, too. The FBI's latest internet crime report warns that artificial intelligence (AI) writing tools now help fraudsters produce official-sounding emails that match an executive's tone, and that voice cloning is turning up in requests for wire payments. Businesses reported more than $30 million in losses to AI-assisted business email scams in 2025, and those are just the ones people owned up to.

Once the pitch moves off email and onto the phone or a text message, it picks up a whole new set of tricks, and a later post in this series covers how attackers use your org chart to pull that off.

The fix here is as much cultural as procedural. If the owner says, out loud and in writing, that any urgent payment request from them gets verified no matter what, employees have permission to double-check without feeling like they're second-guessing the boss. That one sentence takes a lot of air out of this scam.

Habits That Stop the Payment

The defense here is boring, cheap, and very effective, which is a combination security people rarely get to brag about. A handful of habits cover most of it.

1. Call back on a number you already have. Any change to bank details gets confirmed by phone, using the number in your vendor file or on an old invoice, never the one in the email asking for the change.
2. Make two people sign off. A second set of eyes on new or changed payment instructions catches a lot, mostly because the scammer only planned on fooling one person.
3. Slow it down on purpose. A short waiting period on any new banking details, even a single day, defuses "it has to go out today."
4. Make questioning normal. Staff should know that verifying a request from the owner or a longtime vendor is part of the job, not an insult.

If money has already gone out, speed matters more than anything else. Call your bank right away and ask them to recall the transfer, then file a report with the FBI's Internet Crime Complaint Center at ic3.gov, whatever the amount. The FBI's fraud recovery team froze about $679 million in 2025, roughly 58% of the attempted thefts it worked on, and those saves mostly come from fast reports. Waiting a few days to see if the vendor calls is how a recoverable loss becomes a permanent one; the AFP survey found that 20% of victims got nothing back.

After the bank call, loop in whoever runs your IT. If the request came through a real mailbox, yours or the vendor's, somebody needs to figure out how they got in before the next email goes out.

Ask for More Than a Birthday

Vendor fraud works because it doesn't look like fraud. It borrows a supplier's name, a real invoice, and the timing of a busy week, arrives through a convincing lookalike address or a vendor's own compromised account, and slides past spam filters because there's nothing malicious to find. The same trick works with the owner's name on it. What stops it isn't a smarter filter. It's a callback to a known number, a second approver, a little patience with new banking details, and a culture where double-checking the boss is expected.

For most small businesses, the hard part is that payments run on trust and speed. The same one or two people handle every invoice, everybody's in a hurry at month-end, and nobody wants to be the one who offended a longtime vendor by asking for proof. That's exactly the opening scammers count on.

CNWR looks at this problem from both sides of the inbox. On the technical side, that means email security that's set up properly, watching for signs a mailbox has been taken over, and helping lock things down fast when something looks off. On the people side, it means plain advice on the verification habits that make even a convincing email harmless, without turning accounts payable into an interrogation room.

If your payment process still runs on a familiar name and a good feeling, get in touch with CNWR and schedule a call. A birthday shouldn't be enough to pick up the prescription, and a friendly email shouldn't be enough to move the money.

Key Takeaways

• Vendor fraud works by borrowing trust you already have in a supplier or the owner.
• Most of what scammers need comes from public sources or a vendor's real, compromised mailbox.
• Spam filters rarely catch these emails because there's nothing malicious inside them.
• Any change to bank details deserves a phone call to a number you already have.
• Two approvers and a short waiting period stop most rushed payment scams.
• If money moves, call the bank and file at ic3.gov right away.

Frequently Asked Questions

1. What's the difference between vendor fraud and regular phishing?
Regular phishing usually tries to get someone to click a link or open a file so the attacker can steal a password or plant malware. Vendor fraud skips all of that. It's a plain request to send money somewhere new, dressed up as normal business with a supplier you already know. There's often no link at all, which is exactly why it gets past filters and gut checks alike.

2. Can the bank get the money back after a fraudulent wire?
Sometimes, and speed makes all the difference. Banks can try to recall a transfer, and the FBI's Internet Crime Complaint Center works with financial institutions to freeze funds before they move again. The window is short, though. Once the money hops through a few more accounts, the odds of getting it back drop fast, so call the bank first and file the report the same day.

3. How do we verify payment changes without annoying our vendors?
Tell them up front. A short note to your suppliers saying any banking change gets confirmed by phone before it's processed turns verification into policy instead of suspicion. Most vendors appreciate it, since they're just as exposed when someone impersonates them. Use the phone number from your own records, keep the call short, and make a note that it happened.