Vendor Scam

What a vendor scam is and why it works

Vendor scams exploit ordinary business workflows, not software flaws. The attacker pretends to be a trusted supplier or service provider and uses a believable pretext, often around invoices, banking details, or procurement changes, to push staff into acting quickly before they verify the request.

The deception works because vendor relationships already create legitimate exceptions: payment updates, urgent account changes, and message threads that look routine. A scam becomes successful when the request feels familiar enough to bypass caution and the target treats the message as an administrative task rather than a fraud attempt.

Common impersonation patterns

Most vendor scams rely on email spoofing, lookalike domains, and social engineering rather than direct compromise of the vendor’s systems. Attackers may copy signatures, reply to real email threads, or imitate the tone and timing of a real supplier to make the request seem operationally normal.

Some variants focus on changing bank account details so payments are redirected. Others aim to obtain sensitive business information, such as invoice schedules, supplier contacts, or internal approval steps, which can be reused for a more convincing follow-on fraud.

Where the control failure usually happens

Vendor scams succeed when the organisation treats a payment or banking change as a message-verification problem instead of a business-control problem. The weak point is often not the inbox itself, but the absence of a separate verification path, clear authority for approving changes, or a reliable record of who can authorise exceptions.

That is why strong controls typically include callback verification using known contact details, dual approval for payment changes, and identity checks before any supplier master data is updated. The objective is to make the scam fail even if the email looks authentic.

Business impact and recovery

The most immediate impact is financial loss, but vendor scams can also create operational disruption, invoice disputes, supplier relationship damage, and time lost reversing transfers or reviewing related transactions. If sensitive commercial information is exposed, the scam can also widen into broader fraud or targeted follow-up attacks.

Recovery usually depends on speed: confirm whether the change was real, freeze or recall payments where possible, preserve the message trail, and review any related account updates or mail forwarding rules. Organisations should also look for signs that the scam exposed internal approval processes, because that information can be reused against other suppliers or finance teams.

Risk and Threat Considerations

Vendor scams are dangerous because they attack trust in routine business communication. The threat is not limited to a single fraudulent payment request, since a successful impersonation can establish a reusable pretext for future invoice diversion, data theft, or deeper social engineering against finance and procurement teams.

Failure mechanism: The attacker abuses a trusted supplier relationship, then uses urgency, spoofed identity cues, and weak out-of-band verification to get a fraudulent change approved before anyone checks the request independently.

Impact: Funds can be diverted, supplier records can be corrupted, and staff can be conditioned to accept malicious payment instructions, increasing the chance of repeat fraud.

Practitioner Guidance

Why practitioners should care: Vendor scams are a process-control failure as much as a fraud problem, so the strongest defence is to design payment changes so they cannot be completed on email alone. Independent contact verification, separation of duties, and clear escalation rules make the scam materially harder to execute.

What to watch for: Pay close attention to last-minute bank detail changes, slight domain variations, requests that avoid normal approval channels, and messages that pressure staff to bypass established checks. Those signals often matter more than the technical quality of the email itself.

Related resources from NHI Mgmt Group

• What are the signs that a vendor payment request may be part of a third-party reconnaissance scam?
• What are the signs that a vendor invoice scam is likely malicious before payment is sent?
• How do I select an NHI security vendor?
• What is the difference between vendor risk management and identity governance?