Your Vendor’s Email Was Real. The Payment Request Wasn’t.

You check the sender’s address. It is correct.

You recognise the conversation. Your team has been discussing this order for weeks.

The invoice number, delivery details and signature all look familiar.

Then comes one small instruction:

“Please use the updated bank details on the attached invoice.”

There is no misspelled domain to spot. In this kind of scam, someone has gained access to the supplier’s real email account.

The address is genuine. The person sending the message may not be.

How the scam unfolds

The following example is illustrative, showing how a compromised supplier inbox could be used to redirect a payment.

A restaurant group is buying replacement refrigeration equipment from a supplier it has used before. The order is approved, delivery is booked and the final balance is due.

Step 1: Someone gains access to the supplier’s inbox

The attacker gets into an account used for customer correspondence.

The restaurant’s own inbox does not need to be compromised. The attacker can approach it through an existing business relationship.

Step 2: The existing conversation provides the details

Inside the supplier’s mailbox, the attacker finds the order discussion.

They can see which equipment was ordered, who approves payment and when the balance is expected.

Those details help the next message fit the conversation. The attacker does not have to guess which invoice the customer is waiting for.

Step 3: A revised invoice arrives in the same thread

The attacker sends a message from the compromised account:

“Please disregard the previous invoice copy. Our accounts team has updated the banking details. The order and delivery date are unchanged.”

The replacement invoice has the same amount and order reference.

The payment destination is different.

Step 4: The customer asks the wrong channel for reassurance

The restaurant’s accounts assistant replies:

“Just confirming we should use the new account?”

The attacker answers from the same compromised inbox:

“Yes, please. Those are the correct details.”

That reply feels like verification. But the person requesting the change has also supplied the confirmation.

Step 5: Familiar details carry the payment through

The manager recognises the supplier and approves the expected expense. The team sends the balance to the new account.

Later, the real supplier asks when payment will arrive.

The customer paid an invoice that looked right, using instructions the supplier did not authorise.

The important distinction: checking an address and verifying an instruction

Checking the sender’s address remains useful. It can help reveal impersonation.

But a correct address cannot tell you who currently controls the account.

The same applies to an existing email thread. Previous messages can establish the history of an order without proving that the latest payment instruction is legitimate.

The moment that needs attention is the change in where money will go.

Move the verification outside the email conversation

Before using new supplier bank details:

• Call an established supplier contact using a trusted number already held in your records.
• Confirm the requested change and the payment details through that independent conversation.
• Record who performed the check, who they contacted and what was confirmed.
• Give the payment approver access to that record.
• Hold the payment and escalate if verification remains incomplete.

Do not take the verification number from the email requesting the change.

Replying to the same thread may reach the same person who sent the fraudulent instruction.

Make the check routine

Your team should not have to prove that a message is fraudulent before checking a bank-detail change.

A consistent process removes that burden. Staff can say:

“We verify all changes to supplier payment details through our established contact before updating our records.”

That is easier to follow than asking someone to decide whether a polished, familiar-looking message feels suspicious enough.

For your next payment review, ask one question:

“If our supplier’s real inbox were compromised, what would stop us from following the attacker’s instructions?”

Your answer should include a verification step that does not depend on that inbox.

Learn more about SO Mail at soemailsecurity.com.

Available on iOS and Google Play.