What Is Vendor Email Compromise and How Do You Stop It?

Vendor email compromise is a supply-chain email scam where an attacker takes over or imitates a trusted supplier's email account to redirect your payments or steal information. Because the message appears to come from a vendor you already work with, it sidesteps the suspicion a stranger would trigger.

It is a close cousin of business email compromise, but the impersonated party is your supplier rather than your own colleague.

How vendor email compromise works

The attack usually unfolds in stages:

Foothold: the attacker compromises a real email account at one of your vendors, often through phishing, or sets up a convincing look-alike domain.
Observation: from inside a real account, they read past threads to learn how invoices, amounts, and tone normally look.
The hijack: they reply within an existing conversation, or start a new one, announcing "updated banking details" for an upcoming payment.
The redirect: your team updates the vendor record and pays the next invoice into the attacker's account.

Because the message can come from the supplier's genuine address and sit inside a real thread, it is extremely convincing.

Why it is so hard to catch

This scam exploits trust that took years to build:

Real relationship: you have a payment history with this vendor, so a new invoice is expected.
Authentic context: hijacked threads carry real names, real projects, and real prior messages.
Clean signals: there is often no bad link or malware, so spam filters see nothing wrong. We cover that blind spot in why spam filters miss targeted attacks.
Look-alike domains: a single swapped character can pass a quick glance.

The warning signs

Watch for these, especially when money is involved:

A change in bank or payment details for an existing vendor.
A new domain or reply-to address that is subtly different from the usual one.
Slightly altered tone or formatting in an otherwise familiar thread.
Pressure to pay quickly or to treat the change as routine.
An invoice that arrives earlier or differs from the normal schedule.

How to stop vendor email compromise

The strongest defense combines a hard rule with technology:

Verify every banking change out of band. Call the vendor on a number you already have on file, never one from the email, before updating any record.
Lock down vendor master data so changes require dual approval and leave an audit trail.
Confirm new domains. If a supplier suddenly emails from a slightly different address, treat it as suspect until verified.
Help your vendors stay secure, since their compromise becomes your loss.
Add inbox-level analysis that detects impersonation and look-alike domains automatically.

CIVRA is built for this kind of targeted attack. It analyzes sender identity and behavior, flags look-alike domains, scans attachments such as invoice PDFs, and reads the intent of a message, so a "new banking details" email gets flagged even when it sits inside a familiar thread. It works alongside Microsoft 365 and Google Workspace, suits small teams without dedicated IT, and offers a Chrome extension and an Outlook add-in. See the features page.

Where it overlaps with other scams

Vendor email compromise, CEO fraud, and invoice fraud are branches of the same tree. They all impersonate someone trusted to misdirect a payment. The common defense is the same: verify money movements through a channel the attacker cannot control, and put email analysis in front of your team to catch what habits miss.

FAQ

How is vendor email compromise different from regular invoice fraud?

Invoice fraud is the broader category of fake or altered invoices. Vendor email compromise specifically involves an attacker taking over or imitating a real supplier's email, which makes the fraudulent invoice far more believable.

Can it happen even if my own systems are secure?

Yes. The compromise often occurs at the vendor's end, not yours. Their breached account or a look-alike of their domain is used to target you, so your security alone cannot fully prevent it.

What is the single best way to prevent it?

Verify any change to a vendor's banking details by phone, using a number you already have on file, before paying. This one habit blocks the core of nearly every vendor email compromise attack.

How does CIVRA detect vendor email compromise?

CIVRA analyzes sender identity and behavior, flags look-alike domains, and reads message intent, so impersonated supplier emails and banking-change requests are caught before a payment is sent, even inside existing threads.

Your suppliers are part of your attack surface. Defend the relationship. Start with CIVRA or compare plans on our pricing page to keep supply-chain email scams from reaching your team.