Your Supplier Didn't Change Bank Accounts. Someone Pretended They Did.

Vendor payment fraud happens when a criminal poses as one of your suppliers and asks you to send future payments to a new bank account. The email often looks routine, and the money is usually gone by the time the real supplier asks why they were not paid. The best defense is a simple rule: never change a supplier's banking details based on an email alone, and always confirm by calling a phone number you already have on file.

What happened

The FBI's Internet Crime Complaint Center (IC3) released its 2025 report in April. Reported cybercrime losses reached almost $20.9 billion, up 26% from 2024. Business email compromise (BEC), the category that includes fake supplier payment requests, accounted for almost $3.05 billion of those losses, the second-largest category in the report.

Businesses feel it too. In the Association for Financial Professionals (AFP) 2026 Payments Fraud and Control Survey, released in April, 76% of U.S. organizations said they experienced attempted or actual payments fraud in 2025, and 74% said they were affected by business email compromise.

These figures count only reported incidents, so the real number is likely higher.

How the scam works

Vendor payment fraud rarely involves malware. It relies on a believable message arriving at the right moment:

1. The attacker gets into the conversation. They either break into a real supplier's email account or register a lookalike domain, such as one with a single letter changed.
2. They wait and watch. With access to a real mailbox, they can read past invoices, learn who approves payments, and copy the supplier's tone and signature.
3. They send the request. A message arrives saying the supplier has switched banks, often with an updated invoice or a form on letterhead.
4. The payment goes out. Your team updates the vendor record, the next invoice is paid to the new account. The fraud often surfaces weeks later, when the real supplier asks about a missed payment.

Why manufacturers are a natural target

Manufacturers in Silicon Valley and the East Bay often work with dozens or hundreds of suppliers: materials, components, tooling, and freight. That creates the conditions these scams depend on:

• Many vendor records to update, with changes that look normal on their own.
• Large, recurring invoices, so one redirected payment can be expensive.
• Small finance teams where the same person may receive the request, update the record, and send the payment.
• Year-end pressure. The weeks before the holidays bring more invoices, more vendor updates, and more people out of the office, which leaves less time to double-check.

Engineering and construction firms face the same risk with subcontractors, material suppliers, and progress payments.

Warning signs to watch for

• A request to change bank details, especially by email or PDF attachment.
• An email address that is close to, but not exactly, the supplier's usual address.
• Pressure to act quickly or to keep the change quiet.
• A new bank in a different state or country from the supplier's usual one.
• A reply-to address that differs from the sender's address.

A message from a supplier's real, hacked mailbox can pass every check, which is why the process matters more than spotting the email.

What to do this week

• Verify every bank change by phone. Call the supplier using a number from your vendor file or a past contract, never one listed in the email requesting the change.
• Require two people for payment changes. One person enters a change to vendor banking details and a second approves it before any payment goes out.
• Flag new or changed accounts. Hold the first payment to any new bank account until it has been confirmed, and have your accounting system or bank alert you to these changes.
• Tighten your own email. Turn on multi-factor authentication for every mailbox, especially finance and executive accounts. Ask your IT team to set up SPF, DKIM, and DMARC so criminals have a harder time sending mail that appears to come from your domain.
• Brief your AP team before the year-end rush. Walk through this scam with everyone who handles invoices and make it clear that following the verification rule is never a problem, even with a long-time supplier.