Topic starter
27/06/2026 1:39 pm
TL;DR: Vendor email compromise makes up a major share of BEC, with 61% of attacks impersonating external third parties and 87.5% of high-risk VEC using impersonation, according to Abnormal AI's 2026 Attack Landscape Report. The lesson is that workflow-aware verification, not executive-focused filtering, is now the deciding control.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “2026 Attack Landscape Report: BEC Shifts From Internal Impersonation to Vendor Exploitation”.
By the numbers:
- 61% of BEC attacks impersonate external third parties, meaning executive-impersonation defences miss most of the threat.
Key questions
Q: What breaks when vendor communication is treated as trusted by default?
A: Vendor email compromise succeeds when routine business communication is treated as sufficient proof of legitimacy.
Q: Why do billing account update attacks create more risk than fake invoices?
A: Billing account updates are more dangerous because they ask the target to redirect future payments, which requires higher credibility than a one-off invoice.
Q: What are the signs that a vendor payment request may be fraudulent?
A: Common warning signs include a newly registered lookalike domain, a request that redirects bank details, unusual urgency about overdue invoices, and an email that reuses a real signature while avoiding attachments or links.
Practitioner guidance
- Implement out-of-band payment-change verification Require a second channel, such as a known contact method or approved portal, before any bank-detail or remittance change is accepted.
- Separate vendor onboarding from payment approval Make sure a new vendor, a new domain, and a payment request cannot all be accepted in the same email-driven workflow.
- Add workflow-specific rules for billing and RFQ requests Apply different verification steps for invoice inquiries, billing updates, payment inquiries, and quote requests because each pretext carries different risk.
Bottom line: Vendor email compromise is best understood as workflow abuse, not inbox abuse, because attackers exploit normal business communication patterns to trigger payment or information transfer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:04 pm
Workflow-aware fraud controls are now more important than sender-focused controls. The article shows that most BEC is not executive impersonation, but third-party impersonation or vendor-account abuse. That means the real governance boundary is the business process that accepts the request, not the mailbox that delivered it. Practitioners should think in terms of request legitimacy, approval path, and vendor relationship state.
A few things that frame the scale:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
A question worth separating out:
Q: How should finance and sales teams split responsibility for vendor email risk?
A: Finance should own payment and banking verification, while sales should own pre-qualification of inbound quote requests and external contacts. Both teams need shared escalation rules so a suspicious request cannot be approved simply because it arrived through the right inbox. Clear ownership closes the gap between commercial responsiveness and fraud control.
👉 Read our full editorial: Vendor email compromise shows why workflow-aware fraud controls matter