What is the difference between vendor impersonation and executive impersonation in business email compromise?

How vendor impersonation differs from executive impersonation

Both are business email compromise patterns, but they succeed through different trust shortcuts. executive impersonation usually exploits authority and urgency, while vendor impersonation exploits payment and invoice trust, sometimes by intercepting or redirecting an existing business workflow. That difference changes what defenders should verify, who is likely to receive the message, and which controls are most effective.

Vendor impersonation often looks less dramatic than a fake CEO request, which is part of why it slips through. The attacker may spoof a supplier name, register a lookalike domain, or compromise a real partner mailbox and then ask for an invoice update, bank change, or document exchange. Executive impersonation is more likely to push an employee to break normal process under time pressure.

The practical distinction is the source of perceived legitimacy. In executive impersonation, the sender borrows internal authority. In vendor impersonation, the sender borrows external relationship trust, which can make the request feel routine rather than suspicious. A useful way to think about the difference is that one attacks hierarchy, while the other attacks commercial dependency and payment workflow.

Why the business impact changes by impersonation target

Executive impersonation tends to concentrate on urgent approvals, gift-card style fraud, payroll diversion, or fast-tracked exceptions. Vendor impersonation is more often aimed at invoice fraud, altered bank details, redirected settlements, or theft of commercial data exchanged during procurement and fulfillment. The same broad fraud family can therefore land in different operational teams, with different blast radius and different signs of compromise.

That distinction matters because the control failure is not identical. A leader spoof can succeed even when normal procurement controls are strong if a single employee is willing to bypass verification. A vendor spoof may exploit weak supplier onboarding, poor contact validation, or the absence of callback checks before payment changes are accepted. For a concrete case study of how impersonation and payment fraud can converge, see Arup deepfake fraud 2024.

In practice, vendor impersonation is often harder to detect quickly because it can be threaded through an otherwise normal business process. If the email arrives during an active purchase order, contract renewal, or invoice cycle, the request may appear consistent with existing work. That is why payment validation and relationship verification need to be treated as control points, not just email hygiene.

How defenders should separate the two in review and response

Investigation should start by asking which trust relationship was abused. If the message claims to come from an executive, review internal authority patterns, urgency cues, and whether the request tried to override approval chains. If it claims to come from a vendor, verify whether the sender matched known supplier contacts, whether bank or remittance details changed, and whether the request aligned with a current commercial workflow. The attacker’s objective is usually visible in the workflow they try to bend.

When vendor impersonation is suspected, treat the vendor identity, the payment instruction, and the communications channel as separate evidence sources. A message can look genuine while the bank account change is fraudulent, and a real-looking domain can still be detached from the actual supplier. Good response practice is to confirm the request out of band with a previously verified contact path rather than replying through the same thread. The Email Identity and BEC Guide covers the email-authentication and payment-verification controls that reduce this failure mode.

For executive impersonation, the key question is whether the message induced exception handling. For vendor impersonation, the key question is whether the message altered payment routing, invoicing, or document exchange without independent confirmation. Those are different failure signatures, even though both belong to business email compromise. For guidance on social engineering and impersonation verification, the Deepfakes, Social Engineering and AI Impersonation Guide is the most directly relevant companion resource.

Practitioner Guidance

What to verify: For executive impersonation, verify the authority of the requester and whether the action bypasses normal approval. For vendor impersonation, verify the sender, the bank detail change, and the business context independently, because a legitimate vendor name is not enough.

Decision rule: If the request changes payment instructions, remittance details, or supplier contact data, treat it as a vendor-impersonation scenario and require out-of-band confirmation before any transfer. If it seeks urgency-driven exception handling from an employee, treat it as executive-impersonation pressure and slow the process down before responding.

What good looks like: Payment and supplier-change requests should be validated through a known second channel, and staff should be trained to distinguish “authority abuse” from “relationship abuse” so they do not apply the wrong verification pattern.

Practitioner takeaway: The useful split is not just who is being impersonated, but which trust path is being exploited, internal authority or external supplier dependency, because that determines the control that must stop the fraud.

Related resources from NHI Mgmt Group

• What is the difference between lookalike domain impersonation and vendor account compromise in email fraud?
• What is the difference between vendor email compromise and traditional business email compromise?
• What is the difference between clone phishing and business email compromise?
• What is the difference between CEO fraud and business email compromise?