Vendor fraud rarely looks like fraud. There is no urgency, no bad grammar, no suspicious attachment. There is a supplier you have paid eleven times before, a genuine invoice format, and one changed IBAN.
How the chain usually runs
- The attacker compromises a mailbox — often at your supplier, not at you.
- They read months of correspondence and learn the billing cadence and tone.
- They wait for a real invoice, then send a near-identical one with new bank details.
- Finance pays it, because everything about it is consistent with the last eleven payments.
Why technical controls miss it
Nothing malicious crosses the wire. No malware, no credential harvesting page, sometimes not even a spoofed domain — the mail comes from the real account. Your filters have nothing to catch.
The one control that works
Out-of-band verification of any change to payment details, on a phone number you already had on file — never the number in the email. It is unglamorous, it adds a few minutes to a payment run, and it is the difference between a near miss and a six-figure loss. Everything else is defence in depth around that single step. CyberFence’s Fraud & Payment Verification service is currently in private pilot and not yet generally available — the guidance above stands on its own in the meantime.