Vendor Payment Fraud and the Request to Change Where You Pay

Last updated: November 2, 2026

The email will look ordinary. A supplier you have paid for years, a short note about new banking or a new remit to address, and a polite request to use it for the invoice already sitting in your approvals queue.

Quick Summary

Vendor payment fraud works by changing where your money goes rather than by breaking anything. Federal guidance describes the method as business email compromise, and recommends two specific controls: a callback to a number you already held, and a second person inside your business signing off on the change.

• The ask is always a change. New bank details, a new remit to address, a new portal to pay through.
• Call a number you already had. Federal guidance says to use previously known numbers, not the ones in the request.
• Require a second signature on the change, described in that guidance as a secondary sign-off by company personnel.
• Checks are targeted too. Most reported victims used wires, but some used checks.
• Urgency is the tell. One described variant leans on confidentiality and a deadline near the end of a day or week.
• Report it regardless of the amount. The guidance asks for a complaint whatever the loss.

Here is what each kind of change request is really asking for, and what verifies it.

This page is general information about payment controls. It is not legal, security or banking advice, and your bank's rules and your own policies govern what you can do, so treat your bank and your advisers as the authority on a live incident.

On the document side, business checks can carry a second signature line and a stub wide enough to list the invoices being settled, and that pairing is where a redirected payment usually comes unstuck.

What this guide covers

• What is vendor payment fraud?
• Why does a change request work so well?
• How do you verify a change request?
• What is different when you pay by check?
• Which controls belong on the document?
• What do you do in the first hour?

What is vendor payment fraud?

Vendor payment fraud is a payment that reaches a criminal because the instructions were changed without the real vendor's knowledge. Federal guidance describes the usual method as business email compromise, where a legitimate business email account is taken over through social engineering or computer intrusion and then used to move money.

The same guidance notes how the intrusion often starts: a phishing email with a malicious link, which installs software that exposes passwords and financial account information. By the time the request arrives, it may genuinely be coming from inside the vendor's own mailbox.

Who is actually targeted?

Businesses that pay suppliers on a routine schedule. That is the whole qualification. Payment runs are predictable, invoices are expected, and a change of details on an expected invoice looks like housekeeping rather than an attack.

Why does a change request work so well?

Because it asks you to do something you were already going to do. The invoice is real, the amount is right, the relationship is genuine, and the only altered detail is the destination. Nothing about the request feels like a decision, so nobody treats it as one.

Federal guidance describes one variant that adds pressure deliberately: the sender poses as a lawyer or a law firm, says the matter is confidential or time sensitive, and pushes for speed, often near the end of a business day or week when banks are closing.

• It arrives inside a real thread, sometimes from the real mailbox.
• It matches your habits. Guidance notes fraudsters use whichever payment method you normally use.
• It uses a lookalike address when the mailbox itself is not compromised.
• It asks for discretion, which removes the colleague who would have questioned it.

Notice what is missing from that list. None of it requires technical skill against your systems. The attack is aimed at a process, which is why the fix is also a process.

How do you verify a change request?

Two steps, in this order, every time. Federal guidance puts both in writing: verify changes in vendor payment location by adding two-factor authentication, with the example of a secondary sign-off by company personnel, and confirm requests using previously known numbers rather than the numbers provided in the request.

1. Call the number you already hold. From your own records, not from the email, the invoice or the signature block.
2. Speak to a person you have dealt with before, and describe the change rather than asking them to confirm it.
3. Get a second internal sign-off from someone who did not receive the request.
4. Record who verified it and how, against the vendor record and the date.
5. Leave the first payment small where the relationship allows it, then confirm receipt before the next one.

Two technical measures from the same guidance are worth passing to whoever runs your email: rules that flag messages whose sender extension is similar to your own domain, and registering the close variants of your company domain so nobody else can.

What is different when you pay by check?

The request changes shape rather than disappearing. Instead of new bank details, you are asked for a new remit to address, and the payment goes to a mailbox the fraudster controls. Federal guidance is explicit that most reported victims used wire transfers and some used checks.

Where checks differ is afterwards. A wire is built to be fast and final. A mailed check is a numbered instrument that exists physically, can be stopped before it is presented, and leaves a record of where it was sent and who endorsed it.

That is a recovery advantage, not immunity. A washed or altered check is its own problem, and the verification call is still what prevents the loss. Our guide to check washing covers the physical side of that risk.

Sealed envelopes with no visible payment detail are the cheapest part of this. See double window self seal envelopes for the format.

Which controls belong on the document?

Four, and all of them are decided when you order stock and set up a vendor rather than when the suspicious email arrives.

• The payee line matches the registered entity, so a slightly altered vendor name stands out.
• The stub records the invoice numbers, which makes a duplicate or invented invoice visible.
• Two signature lines where your policy wants a second pair of eyes on larger payments.
• A numbered sequence, so a payment nobody can explain appears as a gap or an extra entry.

Our guides to check signing policy and check register cover the policy and the record that sit behind those four.

What do you do in the first hour?

Speed matters more than certainty. Federal guidance sets out the sequence, and the first two steps happen before anyone works out exactly what went wrong.

1. Contact your bank immediately and ask it to contact the receiving institution.
2. Contact the FBI, which works with the Treasury financial crimes unit and may be able to help freeze or return funds.
3. File a complaint regardless of the amount, which the guidance asks for whatever the loss.
4. Label the incident as business email compromise and keep the accounts, banks, dates and amounts together.
5. Preserve the email, including the sending address and anything odd about the wording or the timing.
6. Stop payment where the item is a check that has not yet been presented.

Then fix the process the same week. Almost every business that loses money this way discovers the control it needed was a two minute phone call to a number it already had.

Related reading

• Check washing covers the physical alteration risk on a mailed payment.
• High security business checks covers the stock used where payments are large.
• Check signing policy covers writing the second sign-off into your rules.
• Blank check security features covers what each printed feature is for.

What to do next

Write the callback rule down this week and put a phone number field in your vendor master that nobody can edit from an email. One sentence in a policy and one locked field will stop more loss than any amount of training.

Then look at the stock you pay on. Business checks are printed with the signature lines and stub layout you specify, and high security business checks add tamper resistance for the payments you would least like to lose.

About the Author

Every working day, our presses turn out check stock for U.S. companies of every size. Customers call us about fraud more often than about anything else, and the request is nearly always the same: more room on the stub and a second signature line, usually after an incident rather than before one.

The controls and the reporting sequence described here come from the FBI public service announcement on business email compromise. A live incident needs your bank and law enforcement rather than an article, so make those calls first.