Vendor Email Compromise: When the Fraud Comes From a Real Partner
September 16, 2026
VEC is the hardest variant to catch, because the invoice arrives from a genuine address, in a genuine thread, at exactly the right time.
Vendor email compromise inverts the problem. Your controls are fine. Your vendor's are not, and the fraudulent invoice arrives from their real mailbox, inside a thread you have been reading for months.
Why VEC works so well
Everything that normally triggers suspicion is absent. The sender is genuine and authenticated. The thread has history. The invoice number matches the project. The amount matches the quote. The timing matches the milestone. The only thing changed is the remittance detail — and often the tone is patient rather than urgent, because the attacker has read enough of the relationship to imitate it.
Attackers also wait. Sitting in a construction or manufacturing supplier's mailbox for weeks to catch a single large draw payment is a rational use of their time.
What catches it anyway
- Bank detail change control. Treat any change to remittance information as a high-risk event requiring verbal confirmation to a number already in your vendor master, never a number in the email.
- Vendor master discipline. Restrict who can edit banking details, log every change, and require two people for it.
- Payment anomaly review. Flag first payments to a new account, unusual amounts, and mismatches between invoice and purchase order.
- Thread hygiene. Watch for a reply-to that differs from the sender, or for a thread suddenly continuing from a slightly different domain.
- Reciprocity. Tell your vendors your rule and ask them to apply it to you. Publish it in your onboarding pack.
If you already paid
Move immediately: bank recall, IC3 filing, insurer notice. Our guide to wire fraud recovery after an email hack has the sequence. Then tell the vendor by phone, because they are the ones with a compromised mailbox and other customers exposed to the same invoice.
If you are the vendor
You are now the source of your customers' losses, with contractual and reputational exposure on top of your own. Contain the mailbox, scope it properly, and notify affected customers by voice. Start with our BEC response page.
Business email compromised right now? Call 1-844-LYRA-REC — our incident commanders answer live 24/7 and start containment on the first call. See our business email compromise response page for the first-hour checklist.