A vendor impersonation email is a message that appears to come from one of your real suppliers — same name, same services, often the same invoice format — but is actually sent by an attacker. The goal is almost always money: an "updated bank account" for the next payment, a plausible invoice for something you ordered, or a pressing reason to pay early. Unlike generic phishing, it works because it fits straight into your routine.
TL;DR
- Vendor impersonation exploits trust in an existing relationship: the email looks like one of a hundred legitimate supplier emails you received this month.
- The two payloads are bank-detail changes and fake invoices; payment redirection fraud cost Australians $166.8 million in 2025 (Scamwatch).
- Lookalike domains (one letter off) and hijacked supplier mailboxes are the two main delivery routes.
- The single control that defeats it: verify any bank-detail change by phone on a number you already had — never on a number in the email.
- Phishing simulations with supplier-invoice scenarios give finance and accounts teams safe practice reps.
What vendor impersonation means in plain terms
Most email fraud asks a stranger to trust a stranger. Vendor impersonation asks you to trust someone you already pay. The attacker does not need to build credibility from scratch — they borrow yours: a real supplier name, an invoice number in your sequence, a signature block copied from a genuine email. It is pretexting aimed at your accounts payable, and it is why finance teams are the most targeted people in most small businesses.
The attack is a close cousin of spear phishing and business email compromise; the difference is that the impersonated party is external (your supplier) rather than your own CEO — which makes it feel even more routine to the reader.
How a vendor impersonation attack actually runs
- Research. The attacker identifies your suppliers from public information, tender records, or a previous compromise — either yours or the supplier's. Breached supplier mailboxes are the goldmine: real threads, real invoice formats, real payment terms.
- The lookalike. A domain one character off — supplier.com.au becomes supplier-com.au — or a free-mail account with the supplier's name in the display field. When the attacker controls the supplier's real mailbox, no lookalike is needed at all.
- The ask. Three recurring versions: updated bank details attached to a real invoice number, a follow-up on an "overdue" invoice you never received, or a request to confirm details "for compliance" that harvests your own payment information.
- The redirect. The next legitimate payment lands in the attacker's account. By the time the real supplier chases the unpaid invoice, the money is gone — often overseas within hours.
The red flags staff can catch
| Red flag | What it looks like |
|---|---|
| Domain one character off | Read the sender's full address, not just the display name |
| A bank change with urgency | "Update before month-end or payments bounce" — real suppliers rarely rush this |
| Contact details changed | A different phone number or signatory than the last email |
| Unusual timing | A bank change arrives exactly when a large payment is due |
| Thread hijack residue | A reply chain that suddenly changes tone or adds a new recipient |
| Payment instructions only in the email | Real suppliers confirm big changes through portals or calls |
How to stop vendor impersonation
| Layer | Control | What it does |
|---|---|---|
| Process | Verify bank changes by phone on a stored number | The core defence — never the number in the email |
| Process | Dual approval for payments and detail changes | Two people see every redirect attempt |
| Process | A 30-day cooling rule after any supplier change of details | Catches the slow-burn version |
| Technical | DMARC monitoring on your own domain | You learn who is sending email as your suppliers — and as you |
| Technical | Mail rules flagging external senders with internal-style display names | Surfaces lookalike domains automatically |
| People | Supplier-impersonation scenarios in the training cadence | Finance and accounts staff practise on safe fakes |
| People | A no-blame report path | The near-miss gets reported and logged, not buried |
The process layer carries the weight: no email filter reliably separates a real supplier email from a well-made fake, so the verification call is the control. Make it the written rule, not a folk practice — the cyber security policy for small business should name it explicitly.
Why training decides the outcome
The verification habit fails when it is trained as an IT rule and succeeds when it is trained as muscle memory. Monthly simulations with realistic supplier-invoice scenarios — the same formats attackers use — give accounts teams safe reps, and auto-enrolment turns a click into an immediate lesson rather than a lecture. Reporting matters as much: every attempted impersonation logged means your real suppliers get warned too, because a fake sent to you is often being sent to their other customers the same week.
FAQ
What is a vendor impersonation email? A fraudulent email posing as one of your real suppliers — using their name, format and often a real invoice number — designed to redirect a payment or harvest payment details.
How is it different from invoice fraud in general? Invoice fraud is the broad category; vendor impersonation is the specific method where the fake (or hijacked) identity is your existing supplier, which makes the message far more credible than a cold fake invoice from an unknown company.
What should we do if we already paid the fake details? Contact your bank immediately and ask for a payment recall, then report to ReportCyber and Scamwatch, and tell the real supplier — their mailbox or their customer list is compromised, and other customers are likely being targeted too.
Do email filters stop vendor impersonation? Not reliably. A lookalike domain or a genuine hijacked mailbox carries no malware and often no link, so there is little for a filter to match. The verification call remains the control that works.
Which staff need this training most? Finance, accounts payable and anyone with payment approval. Reception and executive assistants come next — they see supplier communications and are used to relaying instructions without verification.
One last thing
Pull your last three supplier bank-detail changes and ask one question: was each one verified by phone on a number we already had? If the answer is "it looked legitimate", you have a process gap, not a people problem — and it is fixed with one written rule and one practice scenario a month. Cyber Aware's training includes supplier-impersonation scenarios in the monthly cadence, and the accounting teams guide covers the finance-specific drills.