AegisAI Perspectives · 018
Vendor email compromise is BEC sent from a supplier's hijacked or lookalike mailbox to redirect a payment, and a call-back check on bank changes stops it.
Vendor email compromise is business email compromise sent from a supplier's hijacked or lookalike mailbox to redirect a customer's payment. AegisAI's Q3 2026 State of the AI Attack report found 38x more AI Dragnet attacks sent from hijacked accounts2.
AegisAI reads each message against what this sender has sent before and against the request itself, so a bank change from a real vendor address is still questioned7. They get into or copy the vendor's mailbox, hide their access, reply inside a real invoice thread and ask for payment to a new account25.
The FBI's Internet Crime Complaint Center (IC3) defines BEC as a scam against businesses that work with suppliers or regularly pay by wire transfer, carried out by compromising email accounts through social engineering or computer intrusion12. IC3 received 24,768 BEC complaints in 2025, against 21,442 in 202410.
Attackers carry out vendor email compromise in six steps, from getting into the supplier's mailbox to collecting the wire transfer.
MITRE ATT&CK technique T1586.002 lists phishing for credentials, buying them from third-party sites, brute forcing them and paying employees, suppliers or partners for access16. Device code phishing goes after account access instead of a password, and the Threat Watch report on the Wazza kit cites BleepingComputer on a 37x rise in detected device code phishing pages and at least 11 kits4.
A lookalike domain changes one letter or adds punctuation, in the hope that the victim does not notice24. The difference shows in the From address, character by character, and nowhere else in the message.
The FBI lists new or unauthorized mailbox rules as a red flag, such as forwarding to external addresses, autodeletion or hidden folders14. Microsoft lists Inbox rules that forward mail to unknown addresses as a symptom of a compromised Microsoft 365 account19.
MITRE ATT&CK notes that a compromised email account lets an adversary hijack existing email threads17. The reply comes from the vendor's real server, so sender authentication (SPF, DKIM and DMARC) passes9.
The attacker replies in the thread with a change of bank details notice and only has to swap the account details for their own. Microsoft notes that attackers use a compromised mailbox to send to recipients inside and outside the organization18.
IC3 ties BEC to businesses that regularly perform wire transfer payments. A 2026 FBI notice says a compromised carrier does not always realize it until brokers contact it about missing loads booked under its authority15.
AegisAI reads each vendor message against what that sender has sent you before and against the request itself. Authentication passes on mail sent from a taken-over vendor account, so the verdict does not rely on it. The median verdict takes 1.9 seconds, and the email is then removed from every mailbox that received it8. A bank change request from a known vendor is therefore judged on what it asks the reader to do.
The Q3 2026 State of the AI Attack report found phishing rose 49% in the quarter1. The AFP survey behind the payments figures was run in January 2026 among 465 treasury practitioners at U.S. organizations23.
| Measure | Figure | Source | Splits out vendor cases? |
|---|---|---|---|
| Phishing, change in Q3 2026 | Rose 49% | Q3 2026 State of the AI Attack report | No |
| AI Dragnet attacks sent from hijacked accounts | 0.2% to 7.7%, 38x more | Q3 2026 State of the AI Attack report | No, it counts hijacked senders |
| Device code phishing pages detected | 37x rise, at least 11 kits | BleepingComputer, via Threat Watch | No |
| BEC complaints to IC3 | 24,768 in 2025, 21,442 in 2024 | FBI IC3 2025 report | No |
| BEC losses reported to IC3 | $3,046,598,558 in 2025, $2,770,151,146 in 2024 | FBI IC3 2025 report11 | No |
| Organizations that experienced BEC | 74% last year, 63% in 2024 | AFP survey, via Nacha21 | No |
| Organizations that received spoofed BEC emails | 85% in 2025 | AFP survey, via Nacha22 | No |
Read the BEC rows as a ceiling for reported vendor cases, never as the vendor figure itself. IC3 and AFP count every BEC type together, and the report counts hijacked senders within AI Dragnet attacks.
Illustrative example, figures are fictional. Alder Freight bills Kestrel Tools, a 600 person manufacturer, every month by email.
- Day 1 (attacker). An Alder accounts clerk approves a sign-in prompt from a phishing email, and the attacker now holds the clerk's mailbox.
- Day 2 (attacker). An Inbox rule moves any message containing "bank" or "remittance" into a hidden folder.
- Day 9 (real). Kestrel's payables lead writes in the existing thread: "Invoice 4471 for $86,400 is scheduled for Friday."
- Day 9, 40 minutes later (attacker). A reply in the same thread, from the clerk's true address: "Our bank changed this month. Please use the attached details for 4471."
- Day 10 (attacker). A follow up: "Can you confirm it goes out Friday? Our auditors need it closed."
- Day 10 (real). Kestrel's payables lead calls Alder on the number in the vendor master file. Kestrel holds the payment, and Alder resets the account and deletes the rule.
Every attacker message passed sender checks, so only a channel the attacker did not control exposed them.
Vendor email compromise is one form of business email compromise, set apart by whose mailbox the attacker uses. IC3's BEC definition already names businesses that work with suppliers. In vendor email compromise the attacker sends as a supplier the target already pays, from that supplier's real or lookalike mailbox.
IC3 has described criminals spoofing a company's email domain and the display names of current or former employees, so mail sent to vendors appears to come from known sources of business13. Spoofed emails topped the list of BEC types in the AFP survey, reaching 85% of organizations in 2025.
The spoofed message carries a domain that differs from the real one. The hijacked message carries the true address and passes authentication. For the wider family of attacks, read how the main email attack types work in 2026.
Attackers take over a vendor's email account with stolen, bought, guessed or bribed credentials, as MITRE ATT&CK lists under T1586.002. Device code phishing adds a route that targets account access directly, with a 37x rise in detected pages.
AI Dragnet attacks sent from hijacked accounts went from 0.2% to 7.7% in the Q3 2026 report. Each taken-over mailbox gives the attacker the vendor's contacts and its open threads.
For the full sequence of a takeover and its cleanup, read how email account takeover works.
Yes. When the vendor's mailbox is compromised, the request leaves from the true address, and Microsoft notes that attackers use such a mailbox to write to recipients outside the organization.
Authentication passes on that mail. Sender checks confirm the server and the domain, and both are real. The message sits inside a thread the customer already trusts.
A new bank account, a reason for the change and a push for speed all appear inside an otherwise normal conversation.
Rules appear inside the vendor's tenant, and odd requests arrive in the customer's inbox. Check both before you trust a changed payment detail.
Share the first three with your vendors.
Accounts payable teams should verify every vendor payment change request by calling the vendor on a number already on file before any money moves. The attacker controls the email channel, so the check must use a different one.
For the layered checklist, read how to prevent business email compromise.
Track three numbers for 30 days to see whether vendor email compromise is reaching your payables team.
BEC losses reported to IC3 were $3,046,598,558 in 2025, against $2,770,151,146 in 2024. That came from 24,768 complaints in 2025. IC3 does not split out vendor cases, and only reported losses are counted.
Vendor email compromise is BEC sent from a supplier's hijacked or lookalike mailbox. Attackers get in with stolen credentials, hide with mailbox rules, reply inside a real invoice thread and send new bank details.
The AFP survey found 74% of organizations experienced BEC last year, up from 63% in 2024. It surveyed 465 treasury practitioners at U.S. organizations in January 2026.
Attackers add rules that forward, delete or hide mail, so replies about the fraud never reach the real user. A 2026 FBI notice describes compromised firms learning of it only when partners contacted them.
Vendor email compromise is one way to carry out invoice fraud. The attacker uses a real or copied vendor mailbox to change the bank details on a real invoice. Invoice fraud also includes requests from lookalike domains with no mailbox compromise at all.
