An email arrives from a vendor you have paid for years. Their bank changed, here are the new details, and could you please send this month's payment by Friday. The logo is right, the tone is right, and the invoice number even matches.
This is vendor impersonation fraud, and the defense is boring: one phone call. This tip lays out the five checks banks recommend and why the call matters most.
Why it works
The scam does not need to hack anything. It needs one convincing email at the moment your accounts payable person is busy. The FBI's 2025 Internet Crime Report lists business email compromise among the categories with billions of dollars in reported losses.
Check one: call a number you already have
First Hawaiian Bank calls verbal confirmation of new payment instructions one of the most effective safeguards. Use a phone number already on file, not one printed on the suspicious email or invoice. A real vendor is happy to confirm, and a scammer is not on that phone line.
Check two: read the sender address one character at a time
Domain spoofing depends on you skimming. A swapped letter, an extra hyphen, or a different ending can pass at a glance. Look at the actual address, not the display name.
Check three: does the pattern fit
Compare the amount, timing, and frequency against past payments. An invoice that is larger than usual, or arrives off schedule, deserves a second look before it goes anywhere.
Check four: match it to a purchase order or contract
If there is no order or agreement behind the invoice, stop. Finance should be able to point to what was bought before anything is paid.
Check five: treat urgency and secrecy as red flags
Pressure to pay today, or a request to keep it quiet, is part of the script. Legitimate vendors understand a short delay for verification.
The bigger lesson
Fraud controls work when they are simple enough that a busy person will follow them. We help clients pair payment rules with email protections like spoofing filters and alerts through our managed IT services, so the process holds up on a Friday afternoon.
Most invoice fraud dies with a single phone call to a number you already have. We help you write the process, and lock down email so spoofing gets caught first. No pressure, no obligation, just a straight look at your setup.
Book a 10-Minute Discovery Call →Frequently asked questions
What is vendor invoice fraud?
A criminal pretends to be a vendor and asks you to pay a fake invoice or send money to new bank details. The email can look completely real, which is why a call to a known number matters.
Which phone number should I use to verify?
One you already have on file from a past contract, a previous invoice, or the vendor's real website. Never use a number from the email asking for the change.
Should two people approve every payment?
For any bank detail change or unusually large payment, yes. A second approver catches mistakes and scams that one person under pressure will miss.
What if we already sent the money?
Call your bank right away and report it to the FBI at ic3.gov. The sooner you act, the better the chance of recovering funds.
Can safemode IT help protect our email from spoofing?
Yes. We set up email authentication and filtering, and we help write a payment approval process. See our managed IT services or ask for a free assessment.
Sources: First Hawaiian Bank, Vendor Impersonation and Invoice Fraud; Help Net Security, coverage of the FBI 2025 Internet Crime Report
Last updated: November 12, 2026
