Vendor impersonation is the operational form that most business email compromise takes. Rather than inventing a fake invoice, the attacker attaches themselves to an obligation the buyer already intends to pay, which removes every anomaly an approval workflow would normally catch.
The change request is usually accompanied by a plausible reason: a bank merger, an account under audit, a switch to a new treasury provider. Attackers frequently supply letterhead, a signed form, and a phone number, all of which are trivially fabricated and none of which are independently verified in most accounts payable processes.
The attack succeeds at the moment vendor master data is edited. Everything after that point is a correctly processed payment to an incorrect account.
Common questions
An emailed request to update remittance details on an existing supplier record, usually justified by a bank change and often arriving from a genuine or near identical domain.
Treat a bank detail change as a privileged change: verify out of band against a number already on file, require a second approver, and hold the first payment for a short review window.
Sources and further reading
- FBI Internet Crime Complaint Center (IC3), annual Internet Crime Report
- FinCEN advisories and guidance
Citing this entry? Cite as Coffr, LLC and link to https://getcoffr.com/glossary/vendor-impersonation.