What are the signs that a vendor account may be compromised instead of merely spoofed?

How to tell compromise from simple spoofing

Look for a shift in the sender’s normal operating pattern, not just a convincing header or display name. A spoofed account can imitate the surface of a familiar vendor, but a compromised account often starts behaving like an intruder using a real relationship: unusual timing, new wording, unfamiliar urgency, changed invoice details, or requests aimed at a different recipient than usual.

The practical clue is consistency. If the message matches the vendor’s historical business process, it is more likely to be routine or benign. If it departs from the vendor’s established cadence, tone, payment path, or recipient pattern, treat it as a possible account takeover until independently verified.

Behavioral drift is the strongest warning sign

Compromised vendor mailboxes rarely announce themselves with malware-like noise. They usually reveal themselves through subtle drift in language, workflow, and targeting. A message that suddenly becomes more urgent, less formal, or oddly generic may indicate that the attacker is replaying a relationship rather than operating as the real sender.

Pay attention to whether the request fits the vendor’s normal sequence. If invoices arrive from a new address, arrive at a different time of month, ask for a new bank account, or bypass the usual approval chain, those are stronger compromise indicators than a single spelling error or an unexpected attachment.

Behavioral comparison works best when you have a baseline. Historic invoices, prior email threads, known contacts, and established payment instructions give you something to measure against. Without that context, spoofing and compromise can look similar at a glance, which is why verification should rely on an independent channel rather than on message appearance alone.

What to verify before you trust the request

Verification should focus on whether the request matches the vendor’s known business relationship, not on whether the email looks authentic. Use a separate contact path, confirm payment instructions against a trusted record, and validate any change in bank details, recipient, or invoice formatting before actioning it.

When the message touches money, billing, credentials, or account changes, the burden of proof goes up. A real vendor can usually confirm the request through a known phone number, portal, or prior contract reference. A compromised mailbox often cannot survive that second check because the attacker controls the message channel but not the independent relationship.

If you manage vendor risk at scale, preserve examples of normal correspondence, approved payment workflows, and authorized contacts. That evidence makes it easier to spot drift quickly and gives finance, procurement, and security a shared reference point when a message looks plausible but does not fit the pattern.

Risk and Threat Considerations

Vendor account compromise matters because attackers can exploit existing trust to redirect payments, alter invoices, or insert themselves into business workflows without needing a clearly malicious payload. A spoofed message may fail quickly, but a compromised vendor account can persist inside a legitimate thread and look operationally normal until money or data moves.

Failure mechanism: The attacker leverages a real vendor relationship, then changes timing, wording, recipient targeting, or payment instructions just enough to bypass casual review while still fitting the conversation.

Impact: The result can be fraudulent payment, unauthorized data disclosure, or a broader business email compromise chain that is harder to unwind once the request has been acted on.

Practitioner Guidance

What to verify: Treat any deviation in invoice style, urgency, recipient list, or payment destination as a verification trigger, not as a judgment on its own. The key question is whether the request matches the vendor’s normal process and approved contact path.

Decision rule: If a message concerns payment, banking changes, or account recovery and it does not fit the vendor’s historical pattern, pause processing and require an independent callback or portal confirmation before approving anything.

Practitioner takeaway: The best discriminator is not “does this look spoofed?” but “does this behave like the vendor we know?” Compromise usually shows up as process drift, and that drift should be enough to stop execution until verified.

Related resources from NHI Mgmt Group

• What are the signs that a compromised user account is being used for reconnaissance instead of normal work?
• What are the signs that a vendor email account has been compromised for invoice fraud?
• What actions should I take if my OAuth tokens are compromised?
• How should teams respond when a service account token is exposed?