See how attackers hijack vendor threads to redirect ACH and wire payments, which signals to check, and how verified callbacks and dual approval reduce risk.
The invoice number matches. The amount matches. The email includes the delivery discussion your team had last week. Then comes a small administrative update: the vendor has changed banks, so please use the attached payment details.
That's all an attacker needs. The purchase is real, the supplier relationship is real, and the payment is due. The deception sits in the destination account.
Invoice fraud happens when someone manipulates billing or payment instructions to divert money. In a vendor-thread attack, criminals use a compromised mailbox, an impersonating address, or copied correspondence to make a fraudulent banking change look like ordinary accounts-payable work.
For finance and security teams, the strongest response centers on that change. Verify payment details through a trusted channel, require independent approval, and investigate the infrastructure supporting the impersonation. A well-written email can’t approve its own bank account.
The FBI’s 2025 Internet Crime Report (opens in new tab), released in April 2026, recorded more than $3 billion in reported business email compromise losses. Invoice diversion is one pattern within that broader category, rather than the explanation for every reported loss.
The numbers put familiar-looking payment requests in perspective. This is both a financial control and a security problem. An attacker can exploit a real transaction without changing its amount or sending an obviously suspicious attachment.
Quarter-end pressure gives the request useful cover. People are trying to clear invoices, reconcile records, and keep suppliers happy. A “corrected invoice” sounds like just another task to finish, especially when the conversation already includes accurate details.
That pressure doesn’t make finance staff careless. It makes a repeatable process valuable. A banking change should follow the same verification route whether it arrives on a quiet Tuesday or five minutes before the payment run.
Business email compromise uses several methods to make a fraudulent request appear trusted. Understanding the entry route helps teams choose the right investigation and avoid assuming every attack uses a fake domain.
An attacker who gains access to a vendor’s genuine account can read correspondence and reply from the real address. The request might reference an existing invoice, shipment, or payment date because the attacker has seen those details.
A domain check alone won’t expose that case. The address can be legitimate while the person controlling the message isn’t. Investigators need to coordinate with the vendor and review signs of account compromise.
A different route uses an address that resembles the vendor’s. The display name and signature can be copied, while the actual domain contains a small alteration or an added word. A quick glance might register the familiar name and miss the change.
This is where external detection can help. A newly registered imitation, a cloned supplier portal, or a fake contact page can provide leads before a payment request succeeds. Verify ownership and context before treating an unfamiliar domain as malicious.
Quoted correspondence can make a new message appear to belong to an existing discussion. Sometimes the history comes from a compromised mailbox; sometimes an attacker copies or fabricates it and sends it from another account.
Those routes can overlap. “Reply-chain hijacking” describes how the conversation is used, not which account was compromised. The subject line, quoted history, and invoice reference establish context, but they don’t authenticate a banking change.
The FBI’s BEC guidance (opens in new tab) describes spoofed identities, credential theft, and access to legitimate invoice conversations. The common objective is to make an unauthorized payment destination look like business as usual.
Vendor impersonation fraud often borrows the supplier’s identity to trigger a payment-detail update. The pretext can be routine: a bank migration, an audit, a corrected invoice, or a temporarily unavailable account.
The invoice can still match a purchase order. A familiar signature can still sit beneath the message. Neither confirms that the receiving account belongs to the supplier.
Consider a hypothetical request during a weekly payment run. An apparent vendor contact sends a replacement PDF for a genuine invoice. The amount and reference are unchanged, but the account details differ. A follow-up message says the old bank account is closing and asks finance to make the update today.
If the AP specialist edits the vendor record and the next person approves payment from that updated record, the scam has crossed two steps. The second approval can look reassuring while relying on the first person’s unverified change.
That’s why invoice fraud across the supply chain deserves attention at the vendor-record stage. A verified invoice and a verified payment destination are separate checks.
Generative AI can help an attacker write in a vendor’s tone, translate correspondence, and reproduce the wording of routine payment updates. Access to a real thread provides context that makes the imitation more specific.
The FBI’s warning about AI-assisted financial fraud (opens in new tab) describes tools that improve believable text and remove grammatical errors. That warning remains relevant in 2026: fluent copy is weak evidence of identity.
An attacker can also copy invoice formatting without using AI at all. The practical issue is the same. A professional PDF and an accurate sentence don’t establish authority to change where money goes.
Avoid making the investigation depend on proving that a message was AI-generated. A request for new banking details is actionable whether a person wrote it, a model helped, or the wording was lifted from an old invoice.
No single indicator proves fraud. A legitimate vendor can change banks, add a portal, or send an urgent reminder. A combination of changes provides a stronger reason to verify independently:
Treat the bank-detail change as the trigger for verification. Waiting for several red flags can miss an attack sent through a genuine mailbox with calm, accurate wording.
A confirmation call also needs an independent destination. Calling the number in the suspicious invoice lets the attacker supply the evidence for their own request.
A useful control fits the way AP teams work. Give staff a defined owner, trusted vendor contacts, and an escalation route so a questionable change doesn’t turn into an improvised detective assignment.
Dual authorization helps when a second reviewer independently evaluates the evidence. Two people clicking approve on the same unverified email creates two approvals, but only one source of information.
Build the process into onboarding, too. Agree with suppliers on how to handle banking changes and maintain more than one trusted contact where practical. If the usual contact is unavailable, the team needs a safe escalation path, not a convenient workaround.
For training, use realistic social engineering simulations: a genuine-looking thread, a corrected invoice, and a follow-up call. Measure whether staff verify the payment destination and follow the approval process, alongside whether they report the message.
A fraudulent payment calls for an immediate financial response and a parallel security investigation. Preserve evidence while the payment team explores recovery; waiting for a full technical explanation can waste valuable time.
IC3’s incident guidance (opens in new tab) recommends contacting the bank promptly and filing a detailed complaint. Recovery depends on the circumstances and where the funds are; a recall request doesn’t guarantee their return.
After containment, review how the update crossed each control. The useful question is where independent verification failed or became impractical. That gives the team a specific process to repair.
A fake vendor domain might support email, a copied portal, and a phone number advertised as accounts support. Investigating those assets together can reveal more than reviewing the payment message alone.
Doppel’s Threat Graph connects signals across domains, profiles, ads, and messaging into campaigns. That context helps teams investigate external impersonation and identify related assets for disruption.
Brand Protection supports detection and takedowns, while internal identity and finance controls address genuine mailbox compromise and payment authorization. Each part covers a different point in the attack.
Bring security and AP together around useful measures: time to validate a suspicious change, completion of independent verification, time to disrupt impersonation assets, and recurrence. A count of suspicious emails won’t explain whether the payment process held.
Is your team ready to spot a fake vendor portal while stopping an unverified banking change? Schedule a Doppel demo to see how connected threat detection and disruption support your payment-fraud defenses.
