Why do phishing emails that impersonate vendors or executives still work so well?

Why vendor and executive impersonation still succeeds

These emails work because the attacker is not trying to beat every control at once, they are trying to trigger a fast human decision under believable business pressure. Vendor invoices, wire-transfer requests, password resets, and “urgent” approvals all fit routine workflows, so the message feels normal enough to bypass suspicion. The real advantage is often process familiarity, not technical sophistication.

Impersonation also works because people are conditioned to trust familiar names, familiar tone, and familiar timing. When a request appears to come from a supplier, finance leader, or chief executive, the recipient may assume the normal process already happened, especially if the email references an existing project or payment. Attackers exploit that shortcut by making the request look like an exception that should be handled quickly.

Conversation switching makes the scheme more effective. Once the recipient is pushed to call a number, reply to a different mailbox, or continue in chat, the attacker can separate the request from the original message trail and reduce the chance of careful review. That is why verification has to happen through a known-good contact path, not through the channel the attacker already controls.

What makes the scam persuasive at the workflow level

Vendor impersonation usually succeeds when the request is plausible inside the organisation’s own operating rhythm. A fake invoice, bank-detail change, or overdue payment reminder works best when the recipient can imagine that the request belongs to procurement, finance, or operations. The attacker is relying on ambiguity, because the more the email resembles an ordinary business handoff, the less likely it is to trigger a pause.

Executive impersonation succeeds for a slightly different reason: it turns hierarchy into urgency. Staff are less likely to challenge a message that appears to come from a senior leader, especially when the request implies confidentiality, speed, or a one-off exception. That creates a decision environment where the safest answer, verification, is also the slowest one, and many victims choose speed over scrutiny.

The problem is amplified when controls depend on the recipient noticing subtle clues in the message itself. Display names can be spoofed, reply paths can be manipulated, and language can be polished enough to look routine. For that reason, the most reliable defence is not pattern recognition alone, but process discipline that forces a second check before money, credentials, or sensitive data move.

Risk and Threat Considerations

Phishing that impersonates vendors or executives is high-risk because it targets the organisation’s trust model, not just individual inboxes. Once a message is accepted as legitimate, the attacker can push payment fraud, credential theft, or business-email compromise from a single request into a larger operational or financial incident.

Failure mechanism: The attack succeeds when a trusted business relationship is used as the lure and the recipient is pushed to act before validating the request through an independent channel. Social engineering then bypasses normal scepticism by borrowing authority, urgency, and routine process language.

Impact: The likely outcomes are fraudulent payments, exposure of sensitive data, account compromise, and follow-on abuse of internal trust. In cases where the recipient escalates the request to other staff, the attacker can also extend the compromise across teams and suppliers.

Practitioner Guidance

What to verify: Treat any request to change payment details, approve an exception, or move a conversation off email as untrusted until it is confirmed through a pre-established contact route. For vendor requests, confirm the channel and bank details independently; for executive requests, verify through assistant, phone, or approved messaging path rather than replying to the email.

What practitioners underestimate: Training works best when it is tied to specific business moments, not generic “spot the phishing” advice. Finance, procurement, and executive-assistant teams should rehearse the exact decisions they are expected to slow down, because those are the points where attackers usually win the time pressure contest.

Practitioner takeaway: The control objective is to make high-consequence requests boring enough to verify, even when the message is framed as urgent, familiar, or authoritative.

Related resources from NHI Mgmt Group

• Why do familiar-looking phishing emails still bypass well-run security programmes?
• Why do tax agency impersonation emails still work so well against employees?
• Why do domain name scams still work against well-run businesses?
• Why does credential phishing still work in organisations with mature email security?