Vendor Email Compromise: Why It's So Hard to Stop, and What It Takes
Vendor email compromise is hard to stop because the request can come from a vendor's real account, in a thread you already trust, and sometimes the vendor really is changing banks. Stopping it takes detection and policy enforcement working together: detection blocks the compromised vendor emails, and a named person verifies every genuine request to change where money goes, with a record of who checked.
Alan LeFort CEO · · 5 min read
The attacker takes over a vendor's real email account, or imitates it closely, then asks your team to pay an invoice to new bank details.
A typical attack takes weeks. The attacker gets into the vendor's mailbox, reads its threads with your accounts payable team, and waits for an invoice you already expect. Then they reply in the same thread: the bank account has changed, please update your records before the next payment. Some set up a forwarding rule so the vendor never sees your replies.
The FBI's definition of business email compromise starts with this case, describing a scam "targeting businesses or individuals working with suppliers."
Why is vendor email compromise so dangerous?
Because the money moves, and it is hard to get back. A vendor payment is routine, often large, and usually sent by wire or ACH. In 2025, business email compromise caused the second-largest reported losses of any crime type in the FBI's report, after investment fraud.
It also uses the relationship you most want to keep smooth. Your team knows the vendor, has paid them for years, and wants the invoice paid on time. Questioning a routine request feels like friction, and attackers count on that.
Often nobody notices until the real vendor asks why they haven't been paid. By then the money may be gone.
Why is vendor email compromise so hard to detect?
Most email security looks for signs that a message is fake: a spoofed sender, a lookalike domain, a malicious link or attachment. A compromised vendor account can show none of them.
- The sender is real. The email comes from the vendor's own domain and passes SPF, DKIM and DMARC.
- The thread is real. It's a reply in a conversation your team has been having for months.
- There's nothing to scan. No link and no attachment, just a request in plain words.
- The request is normal. Vendors do change banks, so the request looks like ordinary business.
The last point is the hardest. The same request, new bank details for a vendor, can arrive in two ways:
The second email is genuine, and a filter that let it through made the right call. But a genuine bank change is exactly what an attacker copies, which is why every finance team has a rule that says call the vendor first. For how these attacks get past standard checks, see our guides to why VEC passes every check and thread hijacking.
How much does vendor email compromise cost?
Business email compromise losses reported to the FBI reached $3,046,598,558 in 2025, up 10% from $2,770,151,146 in 2024. Complaints rose from 21,442 to 24,768.
The FBI doesn't report vendor email compromise separately, so no public figure splits those losses by type. The signals point the same way, though. In AFP's 2025 survey, 60% of respondents reported an increase in vendor impersonation, and 63% named third-party impersonation as the most common kind of BEC. In the 2026 AFP Payments Fraud and Control Survey, 74% of US organizations said they were affected by business email compromise in 2025.
Our own data shows where the money is. In our Phishing Genome analysis of 32,052 attacks at 45 organizations (April to June 2026), payment and bank-change requests were 3.6% of attacks but more than 98% of the estimated financial exposure.
Why hasn't anyone stopped vendor email compromise?
Because stopping it takes two things that usually live in different places. Detection sits with the security team and decides whether an email is malicious. The payment policy sits with finance and says what has to happen before money moves, such as calling the vendor on the number on file or getting a second approver for large wires.
Each covers half the problem. Detection can stop the compromised vendor emails, but when the email is genuine there is nothing for it to stop. The policy covers the genuine request, but it can't see the email. It depends on someone remembering it on a busy day, and when it works, nothing is recorded. Almost every finance team has the rule. Few can show it was followed on any given payment.
To solve vendor email compromise, detection and policy enforcement have to work together, on the same email, at the moment it arrives. That's what we built.
What we built: Intent Workflows
Intent Workflows, launched on November 5, 2026, reads what every email is asking someone to do, including the genuine ones, and applies your policy to the requests that can't be undone: vendor bank changes, first-time vendor invoices, wire transfers, payroll deposit changes and executive credential resets.
Detection still does its job, and compromised vendor emails are stopped before anyone receives them. For the genuine requests, your team chooses what happens for each kind of request:
- Alert: security sees every one.
- Banner: the email is delivered with your own policy on it, such as "Bank changes are confirmed by phone to the number on file."
- Route: the request goes to the owner you named.
- Hold: the email isn't released until a named person has verified it.
Approvals arrive in Microsoft Teams or email, and approvers sign in through your own identity provider before they can see a held email. Release links expire on the schedule you set. Every hold ends with a name, a time and a record.
Here is what that looks like for a genuine bank change. Brackwell Supply emails updated bank details for invoice 4471. Your policy holds the email for John Doe, your accounts payable lead. He calls the number on file, confirms the change, and releases it. The record shows who checked, when, and what they did. (Brackwell Supply and John Doe are made-up examples.)
For finance, the callback happens every time, and it no longer depends on someone remembering it. For security, every sensitive request is visible, and every hold has an owner and a record. And when the board asks who checked before the money moved, the answer is a name and a time.
Nothing is on until you turn it on, and many teams start in alert mode for a month before adding holds where the risk justifies them. Intent Workflows is available now for Microsoft 365 and Google Workspace. It connects through Microsoft Graph or the Google Workspace API, with no MX record changes. See how Intent Workflows works.
Launched alongside it, AI Instruction Intercept applies the same reading of intent to email written for an AI assistant, and quarantines it before Copilot, Gemini or any AI that reads your mail sees it.
Final Thoughts: What should a vendor bank change process include?
Whatever tools you use, these six parts make the check happen every time and leave proof that it did:
- Use the number already on file, never one in the email or its signature.
- Name an owner for each kind of request: bank changes to the accounts payable lead, wires at or above your threshold to the controller, payroll deposit changes to HR.
- Treat a new vendor's first invoice as a bank-detail change you've never seen.
- Hold the change until it's verified. Don't update the vendor record or release a payment while the check is pending.
- Add a second approver for large payments, someone other than the person who received the request.
- Record who checked: a name, a time and what they did.
FAQ
How do we protect ourselves from vendor email compromise?
In layers, with a person in the loop. Detection stops the compromised vendor emails before anyone receives them. Any genuine request to change where money goes, or to pay a vendor for the first time, is held until the owner you named has called the number on file and confirmed it. Every one of those checks is on record.
How is Intent Workflows different from detection?
Detection decides whether an email is malicious. Intent Workflows decides whether your policy requires a check before the action, whatever the verdict. A real vendor changing banks is a perfectly good email, and your policy still says call them first.
Do we have to hold every vendor bank change?
No. Each workflow can alert, label, route or hold, and you choose per request type. Some teams hold every bank change from day one. Others start by seeing every sensitive request and add holds where the risk justifies the friction.
Who can release a held email?
Only the owner your policy names. Approvers sign in through your own identity provider, Google or Microsoft, before they can see a held email, with an optional second step for high-risk requests.
Should we call the phone number in the email to confirm a bank change?
No. If the email is fraudulent, the number in it may be the attacker's. Call the vendor on a number you already hold in your own records.
What is the difference between vendor email compromise and BEC?
Vendor email compromise is a kind of business email compromise. BEC covers any email scam that tricks someone into moving money or data; VEC is the version that uses a supplier, often through the supplier's own compromised account. Our complete guide to BEC covers the other kinds.