💡 In Simple Terms (For Beginners)
Scammers hack into a supplier's email system and send you a fake invoice with the bank account details changed. You pay the invoice thinking it goes to your regular supplier, but the money actually goes straight into the hacker's account.
- Fraudsters redirect real, expected vendor payments by faking a "bank details changed" email.
- The request blends in because everything else about the invoice looks completely normal.
- Verifying any bank detail change by phone, to a known number, stops this before money moves.
THREAT INTEL · August 4, 2026 · 7 min read · By Hardik Patel
An email arrives from a vendor you already work with, saying their bank has changed and asking you to update the account before the next payment. The amount, the reference number, the tone — all normal. That's what makes vendor payment fraud dangerous: it doesn't look like an attack at all.
Table of Contents - How the Fraud Works - Why This Is Different From Boss Scams - Controls That Catch This Before Money Moves - What We See in Vendor-Risk Reviews - Key Takeaways - Frequently Asked Questions - How iTechFixr Can Help
How the Fraud Works
Vendor payment fraud hijacks a real, expected payment by faking a bank-detail change request, timed to match your normal payment cycle so the switch doesn't stand out as unusual.
The sequence unfolds in five steps. First, access: the attacker gains visibility into a genuine vendor relationship — often by compromising the vendor's own email account, or by intercepting an invoice thread through an earlier phishing attempt somewhere in the chain. Second, the switch: a message is sent appearing to come from the vendor's real email address, or a near-identical lookalike domain, stating that banking details have changed. Third, blend-in: the request is timed to land alongside a real, expected payment cycle, so nothing about the timing feels out of place. Fourth, payment: accounts staff, trusting the existing vendor relationship, update the record and send the next payment to the fraudster's account instead. Fifth, discovery: the real vendor eventually follows up asking why payment hasn't arrived — usually the first sign anything was wrong, often weeks after the money has already moved.
Why This Is Different From Boss Scams
Boss scams impersonate authority inside your own company. Vendor payment fraud impersonates trust in a relationship outside it, which means it bypasses "does this sound like my director" entirely because the request looks like ordinary vendor administration.
That distinction matters for training: an employee who has learned to be suspicious of internal urgency may still update a vendor's bank details without a second thought, because nothing about the request pattern-matches to the fraud they've been trained to recognize. See our related post on WhatsApp impersonation scams for how the internal-authority version of this problem plays out differently.
Controls That Catch This Before Money Moves
Never update a vendor's bank details from an email request alone — confirm any change by phone, using a number from your existing vendor file, not one included in the request itself.
Build these checks into your standing accounts process:
- Treat bank-detail changes as a standing red flag, not routine admin, regardless of how normal the email looks or reads.
- Confirm any change by phone to a number already on file for that vendor — never a number supplied in the request.
- Watch for lookalike domains — a single swapped letter or added hyphen in a vendor's email domain is one of the most common giveaways.
- Separate duties: whoever updates vendor banking records should not be the same person who approves the resulting payment.
What We See in Vendor-Risk Reviews
Hardik Patel, CEH-certified cybersecurity trainer and founder of iTechFixr Infotech LLP, Pimpri-Chinchwad, flags vendor bank-detail changes as one of the most consistent gaps found during VAPT and vendor-risk reviews for manufacturing and trading businesses across the Pune region — the finding that comes up almost every time is that no one on the accounts side has a formal rule requiring phone verification before updating a vendor's payment details.
That gap is cheap to close and expensive to leave open, which is exactly why it's usually the first fix we recommend in these reviews.
Key Takeaways
- Vendor payment fraud redirects a real, expected payment rather than introducing a fake one.
- The request typically comes through a compromised vendor account or a lookalike domain, not your own systems.
- Phone verification against a known contact defeats nearly every version of this fraud.
- Separating who updates vendor details from who approves payments closes the gap structurally.
Frequently Asked Questions
Q: How is this different from a fake invoice scam?
A: A fake invoice scam introduces an entirely new, fraudulent bill. Vendor payment fraud hijacks a real, expected payment by redirecting it, which makes it harder to spot because everything else about the transaction looks legitimate.
Q: What's the fastest way to verify a bank detail change request?
A: A phone call to a contact you already have on file for that vendor — never a number provided in the email or message requesting the change, since that number is controlled by the fraudster.
Q: Can this happen even if our own email system hasn't been hacked?
A: Yes. The compromise often happens on the vendor's side, or through a lookalike domain, meaning your own systems can be completely secure and you're still exposed through the relationship itself.
Q: How often do vendors actually change their bank accounts?
A: [Guessing] Legitimate bank changes are relatively rare for an established vendor relationship, which is exactly why any such request should trigger extra scrutiny rather than routine processing.
How iTechFixr Can Help
Need a compliance-ready risk framework? Let's map your gaps together. iTechFixr helps businesses determine their exact obligation status and builds the detection-to-reporting pipeline needed to genuinely protect your operations.
