“Our bookkeeper got an email from a vendor we pay every month asking us to update their bank details. It looked exactly like their normal invoices.”
That is how a lot of vendor payment fraud starts. Same logo, same invoice layout, same contact who has been sending you bills for years. The only thing different is a short note at the bottom: we changed banks, please send future payments to the account below.
Your bookkeeper updates the vendor record, pays the invoice and moves on to the next one. Nobody thinks twice until the real vendor calls a month later asking why they have not been paid. By then the money has moved through two or three accounts and it is gone.
Why security requires more than email filtering
Most people picture a fake invoice as a sloppy email from a stranger. The ones that cost businesses real money do not look like that.
In many cases the email really did come from your vendor. Someone broke into their email account, quietly read their messages for a few weeks and learned who they bill, how often, what their invoices look like and who approves payment. Then they sent one email from that real account, in the middle of a real conversation.
A good email filter stops a lot of this. It catches most phishing, spoofed senders and lookalike domains before anyone on your team ever sees them, and every business should have one. But no filter is 100%, and an email sent from a real vendor account, with no bad links, asking for one small change to a payment record, is the hardest kind to catch.
That is why email filtering has to be one layer of many in your security stack. Technology stops what it can. Governance, meaning the clear rules your team follows every time, catches what gets through. You need both.
The FBI calls this business email compromise. According to the FBI’s 2025 Internet Crime Report, businesses reported more than $3 billion in losses to it last year, most of it through wire transfers. That only counts the cases that got reported.
Why year-end makes it worse
In November and December, finance teams are closing the books and trying to clear a stack of invoices before the holidays. People are out of the office. Approvals get rushed. Attackers know this. A request that would get a second look in March slides right through in late December.
The best protection against vendor payment fraud is a phone call
The strongest governance step here costs nothing and takes about two minutes.
Before anyone changes a vendor’s bank details, they call the vendor at a phone number you already have on file. Use the number in your vendor record, your contract or the vendor’s website that you look up yourself. Never use the number in the email or on the new invoice, because that number may go straight to the attacker.
If the request is real, the vendor confirms it and you spent two minutes. If it is not, you just saved the payment, and you get to tell your vendor their email has been hacked.
The catch is that this only works if everyone does it, every time. The person who is buried in invoices on December 28 is the one who needs the rule most.
How to make the call a standard step
- Put it in writing. Add one line to your payment process: no change to vendor bank details without a callback to a known number.
- Keep a master list of vendor contacts outside of email. Store a verified phone number for every vendor in your accounting system so nobody has to go looking in an inbox.
- Require two people for bank changes and large payments. One person makes the request and a second person approves it. It is much harder to fool two people than one.
- Treat urgency as a warning sign. “Please process today” or “our old account is closed” is exactly the pressure an attacker wants you to feel.
- Tell your vendors. Let them know you will always call to confirm a bank change. It protects them too.
- Know what to do if money goes out. Call your bank right away and ask them to recall the wire, then file a report at ic3.gov. The first few hours matter most.
Where i4DM fits
The phone call is the governance layer. Technology is the layer that stops most of these attempts before anyone has to pick up the phone, and i4DM puts both in place.
- AI-based email protection that learns how your organization normally communicates and stops messages that break the pattern, like a vendor you have paid for years suddenly asking to send money somewhere new.
- Email protection that marks messages from outside your organization and screens out lookalike domains, like a vendor name with “-billing” tacked onto it.
- Cybersecurity awareness training and phishing simulations, so your finance team knows what a fake payment request looks like before a real one shows up.
- Phishing-resistant MFA and monitoring for unusual sign-ins, so your own email account never becomes the one used against your customers.
- Help building a payment verification step into your security policies, so the phone call becomes a habit.
The invoice will look real. Make sure your process does not depend on spotting the difference.
Not sure how your team would handle that email? Start with an i4DM IT Security Check-Up. Call 410-846-9138 or reach out online.