How the Fake Vendor Invoice Scam Works, and How to Stop It Before You Pay
By Yan Payments
What is the vendor invoice scam, and how much is it costing businesses?
A scammer gets into, or convincingly fakes, a real supplier’s email account, waits inside an actual invoice thread, then tells you their bank account changed. You update your records and the next payment goes straight into the fraudster’s account while your real vendor is still waiting to get paid. The FBI’s 2025 Internet Crime Complaint Center report put business email compromise losses at just over $3 billion for the year, roughly $3.05 billion across nearly 25,000 complaints, making it the second-largest category of reported cybercrime loss behind investment fraud.
Why does this version of the scam work so well?
Older BEC scams impersonated the CEO asking an employee to wire money fast. That trick still works sometimes, but a lot of finance staff have been trained to be suspicious of urgent requests from the boss. The vendor version is harder to catch because it doesn’t ask you to do anything unusual. It just asks you to update a detail in a process you already run every month: paying an invoice. According to Abnormal AI’s 2026 threat report, a majority of business email compromise attacks now impersonate an outside party, like a supplier, rather than someone inside the company, and requests to change billing or bank details are among the riskiest kind of message finance teams receive.
The scariest version isn’t even a fake email address. Attackers increasingly get into the vendor’s real mailbox, so the message comes from the vendor’s actual domain, inside the actual thread you’ve been emailing for months. Every prior email in that thread is genuine. That’s exactly what makes the fake one, sitting right below it, look genuine too.
What does this actually look like landing in your inbox?
Usually it’s unremarkable. You’ve been getting invoices from the same supplier for a year. Then one message arrives saying they’ve switched banks, maybe with a line about a merger or a new accounting system, and asks you to update their ACH or wire details for the next payment. Sometimes there’s a new W-9 attached. Your accounts payable person updates the vendor file and pays the next invoice as usual. Weeks later, the real vendor calls asking why they haven’t been paid, and that’s the first anyone learns the money went somewhere else.
How do you verify a bank-detail change without insulting a real vendor?
The fix isn’t more suspicion of every email. It’s one specific habit, applied every time, no exceptions:
- Call the vendor using a phone number you already have on file, from a signed contract, a business card, or an old invoice, never a number listed in the email making the request.
- If you don’t have an independent number, call the vendor’s publicly listed main line and ask for a contact you already know by name.
- Confirm by voice only. Don’t confirm or exchange banking details over email in either direction, even to “just double check.”
- Treat every bank-detail change request as unverified until that callback clears it, no matter how normal the thread looks or how long you’ve worked with that vendor.
- Get a second person to sign off before anyone updates the vendor master file. One person acting alone is how these get through.
- If anything feels off, hold the first payment under the new details for a day while you sort it out, then release it once confirmed.
That last point matters because a real vendor mailbox compromise defeats every check you’d normally rely on. The domain is legitimate, the signature is right, the thread history checks out. None of that proves the new bank account is real. Only a phone call to a number you already trusted does.
What do you do if you already paid the wrong account?
Call your bank the same day, ideally within hours, and ask about a wire recall or an ACH reversal. Recovery odds drop fast with every hour that passes, so this isn’t something to sit on overnight. File a complaint at ic3.gov, which is the FBI’s channel for exactly this kind of fraud and sometimes helps law enforcement trace funds across accounts before they’re moved again. Call your actual vendor too, both to let them know their invoice didn’t go missing, it got hijacked, and because they may be fielding the same scam from other customers.
Make this part of the routine, not a one-time memo
Sending one email about this won’t stick. Build the callback-verification step into however you already onboard new vendors and update existing ones, so it’s just part of the process rather than something people have to remember under pressure. If you invoice clients yourself and want your own payment instructions harder to spoof, keeping your invoicing clean and consistent gives your customers a clear pattern to notice when something looks wrong.
If your business pays suppliers by ACH, wire, or check and nobody has walked your AP team through this specific scenario, that’s worth doing before it happens to you, not after. Talk to us if you want a second set of eyes on how your payment and invoicing setup handles this kind of risk.
Sources:
← Back to all posts