Why do third-party email gateways lose effectiveness against business email compromise and vendor fraud?

They often rely on payload inspection and known-bad indicators, which are weaker against socially engineered messages that look technically clean and context rich. That means the control can miss attacks that target trust, workflows, and payment or account changes. Behavioral detection and user context are more effective for these cases because they look for anomalies in intent, relationships, and sending patterns.

Why This Matters for Security Teams

Third-party email gateways are designed to stop malicious content, suspicious links, and known-bad infrastructure. That works well against commodity phishing, but business email compromise and vendor fraud usually arrive as legitimate-looking conversation, not obviously malicious payloads. The message may be clean, the sender may be plausible, and the real abuse happens later when a process owner approves a payment, updates bank details, or grants access based on trust.

This is why the control often fails at the point most teams expect it to help. Email security alone cannot reliably judge whether a request fits the normal business relationship, whether the sender identity was hijacked, or whether the message is trying to bypass change control. NIST guidance on layered security and access control, including NIST SP 800-53 Rev 5 Security and Privacy Controls, is a better fit for these cases because it pushes defenders toward process, verification, and monitoring rather than mail filtering alone.

In practice, many security teams encounter vendor fraud only after a payment instruction or account change has already been approved through a trusted workflow.

How It Works in Practice

Effective defence against business email compromise is less about blocking every suspicious email and more about adding friction where fraud succeeds: identity, authority, and process. A third-party gateway can still reduce baseline noise, but it should be treated as one layer in a broader control set that includes mailbox hardening, payment verification, and anomaly detection on communication patterns.

The practical issue is that these attacks frequently abuse normal business language. Fraudulent messages ask for urgent wire changes, new beneficiary details, invoice resubmission, or credential resets. They may come from compromised supplier accounts, lookalike domains, or even a legitimate vendor account whose mailbox has been taken over. Because the content is often syntactically valid and contextually relevant, simple signatures and reputation scoring have limited value.

• Verify payment and banking changes out of band, especially when urgency is part of the message.
• Treat sender display name, domain similarity, and reply-chain anomalies as signals, not proof.
• Use behavioural detection to spot unusual recipient patterns, timing, tone shifts, and first-time requests.
• Require stronger checks for high-risk workflows such as accounts payable, payroll, and procurement.
• Monitor delegated mailboxes, forwarding rules, and consent grants because compromise often persists there.

There is also an identity angle when vendors use shared inboxes, service accounts, or automation to exchange invoices and approvals. Weak governance around these non-human identities can make a clean email look trustworthy even when the underlying account is compromised. That makes identity assurance, mailbox controls, and workflow verification more important than message filtering alone, especially where OWASP Non-Human Identity Top 10 risks map to service accounts, API-driven notifications, or automated approvals.

These controls tend to break down when finance and procurement teams rely on email as an approval system because the process itself rewards speed over independent verification.

Common Variations and Edge Cases

Tighter verification often increases workflow friction, requiring organisations to balance fraud resistance against operational speed. That tradeoff is especially visible in small businesses, distributed procurement teams, and supplier ecosystems that depend on fast turnaround and minimal process overhead.

Best practice is evolving for AI-assisted fraud and highly personalised social engineering. Current guidance suggests that defenders should not assume a clean message is a safe message, because attackers can use language models to improve tone, timing, and contextual fit. The same pattern appears in broader AI-enabled social engineering research, including the Anthropic – first AI-orchestrated cyber espionage campaign report, which reinforces how automated assistance can make malicious communications harder to distinguish from legitimate correspondence.

There is no universal standard for this yet, but the strongest programmes combine email telemetry with payment controls, account-change verification, supplier onboarding checks, and user reporting. In practice, fraud losses often stem from a control gap between the inbox and the business system, not from the gateway itself. If the organisation does not enforce independent confirmation for changes to bank details, destination accounts, or executive approvals, the gateway will not compensate for that weakness.

Related resources from NHI Mgmt Group

• How should security teams reduce business email compromise risk beyond secure email gateways?
• How should organisations defend against business email compromise when attackers use real conversations?
• Why do secure email gateways fail against modern phishing and invoice fraud?
• Why do secure email gateways miss modern business email compromise?