If you received an email saying a vendor changed their bank details, verify it by calling the vendor at a phone number you already have on file, not from the email. This single step defeats most vendor payment fraud. The FBI's IC3 2025 report recorded US$3.05 billion in business email compromise (BEC) losses, and the Canadian Anti-Fraud Centre reported CA$67.9 million in spear phishing losses. Both agencies recommend out-of-band verification: confirm any banking detail change using a separate communication channel before processing it.

Vendor payment fraud is when a criminal pretends to be one of your suppliers and asks you to send the next payment to a new bank account. It is a form of business email compromise (BEC), and it works because changing banking details looks like routine admin. The control that stops most of it is simple: never change a supplier's banking details without calling the supplier back on a phone number you already have on file.

How do you check if a vendor bank-detail change is fraud?

When you receive an email asking to change a vendor's banking details, follow these steps before making any update. Every step can be completed in minutes, and skipping any one of them is how most vendor payment fraud succeeds.

  1. Do not reply to the email or use any phone number it contains. Attackers control those channels. Any response goes directly to them, not to the real vendor.
  2. Call the vendor on a phone number you already have on file. Use the number from your accounting system, a signed contract, or a previous invoice, not the number in the email requesting the change.
  3. Confirm the request with someone other than your usual contact. If you normally work with one person at the vendor, ask to speak with their finance department or a second contact. Attackers often compromise a single mailbox and cannot intercept calls to other people at the company.
  4. Check the sender domain and reply-to address. Spoofed emails often come from domains that are one character off (e.g., "supp1ier.com" instead of "supplier.com") or use a different reply-to address than the from address. Hover over the sender name to see the actual email address.
  5. Hold the payment until the change is verified, and require a second approver. No single person should be able to both approve a banking detail change and execute the payment. Dual authorization is a standard control recommended by the Competition Bureau of Canada.
  6. If money has already been sent, call your bank immediately and report. Request a wire recall. Then report to the Canadian Anti-Fraud Centre (Canada) or the FBI's IC3 (United States). Recovery rates improve when reports happen the same day as the wire.

Business email compromise (BEC) generated US$3.05 billion in reported losses across 24,768 complaints to the FBI's Internet Crime Complaint Center in 2025, according to the IC3 Annual Report. Vendor payment fraud (someone pretending to be a supplier emails new banking details, and your accounts-payable team wires the next invoice to a criminal) is one of the most common forms. By the time anyone notices, the money is gone.

This is not a high-tech exploit. It works because businesses trust the suppliers they pay every month and assume an email about updated bank details is routine. For Canadian and U.S. small and mid-sized businesses, a single successful wire diversion can mean tens or hundreds of thousands of dollars lost, money that is rarely recovered.

What is vendor payment fraud, and why is it so common?

Vendor payment fraud is a form of business email compromise (BEC) where an attacker impersonates a supplier your company regularly pays. The FBI's IC3 recorded 24,768 BEC complaints in 2025, up from 21,442 the year before, making it the second-highest-loss category of internet-enabled crime behind investment fraud. The Association for Financial Professionals' 2026 Payments Fraud and Control Survey found that 74% of surveyed organizations experienced BEC attempts in 2025.

The scam is common for three reasons. First, payment-detail changes happen legitimately: banks close, companies restructure, suppliers switch processors. A request to update account numbers does not immediately raise alarms. Second, the attacker often has real context: they may have compromised a vendor's mailbox or researched your invoicing schedule from leaked data, so the timing and tone feel authentic. Third, AI tools now produce error-free, natural-sounding email in any language, eliminating the grammar mistakes that once helped staff spot fraud.

How does a vendor payment fraud attack actually happen?

The typical attack follows a predictable sequence. The Canadian Centre for Cyber Security and the FBI both describe variations of the same playbook, though details vary by industry and attacker sophistication.

  1. Reconnaissance. The attacker identifies your company's key vendors by scraping invoices from stolen mailboxes, examining press releases about partnerships, or buying lists on criminal forums. They learn who your accounts-payable contact is, what the invoicing schedule looks like, and how much the typical payment is worth targeting.
  2. Impersonation. The attacker sends an email that appears to come from the vendor, either by spoofing the domain (if your mail server does not enforce DMARC, DKIM, and SPF) or by compromising the vendor's actual mailbox. The email is professional, references a real invoice number or purchase order, and requests a routine-seeming change: "Our bank account has been updated. Please use the new details below for all future payments."
  3. Execution. Your AP clerk updates the payment record and processes the next invoice. The wire goes out to an attacker-controlled account, often overseas.
  4. Cash-out. The attacker moves the money immediately: splitting it across multiple accounts, converting to cryptocurrency, or wiring it to another jurisdiction. The FBI notes that once funds leave the originating bank, recovery rates are low unless the fraud is reported within hours.

Who is most at risk?

Any company that pays vendors by wire or electronic transfer is a potential target, but small and mid-sized businesses face disproportionate exposure. The AFP's 2026 survey found that 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, with BEC the single largest category. SMBs are often targeted because:

  • Fewer verification layers. In a larger company, changing a vendor's banking details may require dual approval, a call-back to a known number, and a waiting period. In a smaller firm, one person in accounting may handle the request alone.
  • High implicit trust. Smaller teams know their vendors personally and are less likely to question an email that sounds familiar. Attackers exploit this by using casual language or referring to past conversations they have seen in a compromised mailbox.
  • Limited email security. Many SMBs lack advanced email filtering, external-sender warnings, or enforced authentication protocols, the technical controls that would block or flag a spoofed message before it reaches an inbox.

Canadian businesses face the same risk profile. The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 warns that fraud and scams remain "almost certainly the most common form of cybercrime impacting Canadians" and that AI-powered phishing will make these attacks harder to detect.

The Canadian Anti-Fraud Centre's Top 10 frauds in 2025 ranks spear phishing second by reported dollar loss, with 813 reports, 571 victims and CA$67.9 million lost, behind only investment fraud. The CAFC describes spear phishing and BEC as attacks where fraudsters impersonate trusted contacts, including vendors, and in a July 2025 release about a Vancouver-area law firm that wired funds to a fraudulent account in Hong Kong, it advised businesses to verify every payment request that changes banking details by calling a trusted phone number. The same release estimates only 5 to 10% of fraud victims report to the CAFC, so the real number of Canadian cases is higher.

Why do employees fall for it if the tactic is so well-known?

Awareness is not the same as vigilance under pressure. The Canadian Competition Bureau's business fraud guidance describes common scripts: attackers may claim "a contract is in danger if a supplier isn't paid immediately" or "threaten to escalate the issue to your CEO if payment is not made immediately." When an email arrives at a busy moment, references a real invoice, and comes from what looks like a trusted sender, even cautious staff may act before verifying.

Attackers also exploit organizational blind spots. If the person receiving the email is not the same person who set up the vendor relationship originally, they may have no reference for what a legitimate request should look like. And if your company has no written procedure for verifying payment-detail changes, there is nothing stopping the clerk from simply doing what the email asks.

What controls actually stop vendor payment fraud?

The most effective defenses are process controls, not just technical tools. The FBI, CCCS, and payments-industry bodies like NACHA all recommend variations of the same core measures.

Verify every banking-detail change through a separate channel

Before updating any vendor's payment information, call the vendor using a phone number you already have on file, not the one in the email requesting the change. Confirm the request with a person you know at the vendor. This single step defeats most vendor payment fraud because the attacker cannot intercept a phone call to a number they did not provide.

Require dual authorization for high-value or sensitive transactions

No single employee should be able to both approve a vendor-detail change and execute the payment. Separating these functions means an attacker would have to compromise two people (or two accounts) to succeed. For wire transfers above a threshold your organization defines, require sign-off from a second manager.

Tag external emails visibly

Configure your mail system to prepend a banner or tag (such as "[EXTERNAL]") to every email originating outside your domain. This reminds staff that the message is not from a colleague and should be treated with appropriate skepticism. Microsoft 365, Google Workspace, and most on-premises mail servers support this setting.

Implement and enforce DMARC, DKIM, and SPF

These email authentication protocols help prevent attackers from spoofing your own domain or your vendors' domains. They are not a complete defense (a compromised vendor mailbox will still pass authentication), but they raise the bar significantly. Ask your IT provider or managed service provider to confirm these are configured and set to "reject" or "quarantine" failures, not just "monitor."

Enable MFA on all email accounts

A vendor payment fraud attack is far more dangerous when the attacker operates from inside a compromised, legitimate mailbox (yours or the vendor's). Multi-factor authentication adds a critical layer of protection against account takeover. Push it to every user, especially finance and executive accounts.

Train AP staff specifically for BEC, not just generic phishing

Generic security awareness training teaches employees to spot typos and suspicious links. BEC emails often have neither: they are well-written, contextually accurate, and ask for a routine action. Train accounts-payable staff to treat any request to change banking details as a verification trigger, regardless of how professional the email looks.

What should you do if a payment was already sent?

Speed is critical. The FBI's Recovery Asset Team (RAT) has frozen fraudulent accounts and recovered funds in cases where the victim reported within hours, but the window is narrow. If you suspect a wire was diverted:

  1. Contact your bank immediately and request a wire recall. Explain that the transaction may be fraudulent.
  2. Report the incident to the FBI's IC3 at ic3.gov (U.S.) or the Canadian Anti-Fraud Centre at 1-888-495-8501 (Canada). Both agencies track BEC and may be able to assist with cross-border recovery.
  3. Notify your IT team or provider so they can investigate whether a mailbox was compromised and whether other payment records need review.
  4. Preserve all evidence: the original email, headers, any attachments, and the payment record. You will need these for law enforcement and insurance claims.

Recovery rates improve when the report happens the same day as the wire. The FBI's Recovery Asset Team has demonstrated success in freezing funds when victims report quickly, but the window is narrow.

One question to ask your IT lead or provider this week

If a vendor emails requesting new banking details, what is our documented procedure for verifying the change before we update the payment record, and does every AP team member know it?

If the answer is "we don't have one" or "it depends on who's working that day," the gap is already there. A ten-minute conversation now is far cheaper than a six-figure wire loss later. If you'd like an outside perspective on where your email and payment controls stand, our free cybersecurity assessment takes about five minutes and covers business email compromise, MFA, and related risks.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. Statistics on business email compromise are based on the FBI IC3's 2025 Annual Report, the Association for Financial Professionals' 2026 Payments Fraud and Control Survey (reporting on 2025 data), and guidance from the Canadian Centre for Cyber Security. Organizations should consult qualified cybersecurity and legal professionals before making operational changes based on this article.