4 min read · Beginner · Related: Managed IT Services

Updated October 2026 · Tampa Bay–tested steps

Vendor Email Compromise: Verify Before You Pay

Your vendor's hacked mailbox sends perfect invoices with new bank details — the verification ritual that catches it.

  1. 1. Treat every bank change as hostile until proven

    New account numbers trigger mandatory callback verification to a KNOWN contact — built into your AP process, no exceptions for amount, urgency, or authority. The rule protects against real vendor hacks, not just fakes.

  2. 2. Inspect the message forensically

    Check headers for SPF/DKIM fails, reply-to mismatches, and lookalike domains. Real vendor compromise passes authentication (it's their actual account) — so content scrutiny matters more than technical flags here.

  3. 3. Confirm through a second channel and person

    Call the vendor contact AND loop in a second approver internally. Two humans, two channels, one verified payment — BEC dies in committee.

Vendor Email Compromise: Verify Before You Pay — When to Call a Pro

  • Payment already sent — recall process plus forensics immediately.
  • Your OWN mailbox was the compromised vendor — containment and customer notification.
  • AP workflow redesign with verification baked into the process.
Get help with this(813) 702-3155

Guide FAQ

That's exactly what makes VEC dangerous — authentication passes because the account is genuinely hijacked. Process (callbacks) beats technology here.
Domestic wires within hours: sometimes. After 72 hours or internationally: rarely. The callback ritual exists because reversal usually fails.
Was this guide helpful?

Keep going on Managed IT Services

Customer Wi-Fi for Your Business? Do It Without Risking the Office5 min readPower's Out6 min read5G Failover Internet for Small Business4 min read

Related service: Managed IT Services →