AegisAI Perspectives · 065
Manufacturers stop supplier invoice fraud by checking each bank change request on its content and calling a number on file before any payment goes out.
Manufacturers stop supplier invoice fraud by checking each bank change request on its content and calling a known number before paying, since 45% of companies were targets of vendor imposter fraud in 20245. The FBI advises verifying all payment changes in person or via a known telephone number4. AegisAI judges each request against what that supplier has sent before, so a hijacked mailbox that passes authentication still gets a verdict21.
The losses are large. Business email compromise losses reported to the FBI reached $3,046,598,558 in 20251. Manufacturing tops the X-Force target list for the fifth year19. The guide to email security for manufacturing covers the wider sector risks. This page covers one attack and the steps that stop it.
It gets past because the fraud email often comes from the supplier's real account. Criminals use what they gather inside compromised accounts to impersonate email between businesses and their vendors2. A hijacked vendor mailbox signs as itself, so sender authentication passes20.
Built-in impersonation protection has the same gap. User impersonation protection in Microsoft Defender for Office 365 doesn't work if the sender and recipient previously communicated via email14. A supplier you pay every month has emailed your accounts payable team many times.
Set the mail platform controls first, then the payment controls, in this order.
In Microsoft 365, disabling automatic forwarding in the outbound spam policy disables Inbox rules and mailbox forwarding that redirect mail to external addresses15. In Google Workspace the forwarding option is on by default16, so clear the Allow users to automatically forward incoming email box in the Admin console17.
In Exchange Online PowerShell, Get-InboxRule with the IncludeHidden switch lists rules that redirect or forward messages13. A rule that forwards mail to an unknown address is a symptom of a compromised mailbox12.
In Google Workspace, advanced phishing protection can protect against messages from domains that look visually similar to your company's domains18.
Authentication passes on a hijacked supplier mailbox, so judge the request against what this sender has sent you before.
The FBI advises verifying all payment changes in person or via a known telephone number. Never use a number from the email that asks for the change.
Commerce Bank recommends sign-off by two or more people for large payments or changes, and for unusual or out-of-cycle invoices6. The guide on how to prevent business email compromise covers these finance controls in more depth.
If a fraudulent payment is made, reach out to your bank immediately for help addressing the issue11.
Supplier invoice fraud in manufacturing is payment diversion: a real payment to a supplier goes to an account the criminal controls. Commerce Bank describes payment diversion fraud as legitimate payments redirected to fraudulent accounts, and ghost vendor fraud as payments made to fake or nonexistent suppliers7. In manufacturing, the route this page covers is a compromised supplier mailbox. One compromised account can pivot to multiple victims within an industry3.
Watch for three schemes, and note that only one of them uses a fake company.
The guide on detecting a trusted vendor account takeover covers the first scheme in more depth.
Detect them by reading the request and the supplier record together, not the headers. Commerce Bank lists red flags including a vendor's address or contact information changing suddenly, and a payment to a known vendor much higher than the typical invoice total8. Use this table to decide where each signal is checked.
| Signal | What to look for | Microsoft 365 | Google Workspace |
|---|---|---|---|
| Bank change in an old thread | A new account number on an open invoice | Read the request itself | Read the request itself |
| Mail from a known supplier | Impersonation checks skip past correspondents | Anti-phishing policy | Advanced phishing protection |
| Hidden forwarding | Rules that forward to unknown addresses | Get-InboxRule with IncludeHidden | Automatic forwarding setting |
| Look-alike domain | One word added to a real vendor domain | Message headers | Similar domain protection covers your own domains |
| Changed contact details | Address or phone changed suddenly | Vendor file in AP | Vendor file in AP |
| Unusual amount | Much higher than the typical invoice | Two approvers in AP | Two approvers in AP |
Illustrative example, figures are fictional. A plant in Michigan that makes stamped brackets buys steel coil from the same service center every month. The billing contact at the service center has a hijacked mailbox. Inside a four-week thread about PO 5521, the attacker writes that receivables have moved to a new bank and attaches a remittance form for $84,300. Sender authentication passes. Accounts payable sees the first bank change from this supplier in two years, calls the number in the vendor file, and the real contact says nothing has changed.
AegisAI is API-native email security for Microsoft 365 and Google Workspace that works out of the mail path24. The verdict rests on what this sender has sent you before and on the request itself. In a recurring vendor-invoice campaign against Markforged, it caught 33 of 33 BEC emails. It can run in monitoring mode on live mail with no MX change, then turn on removal.
The framework that fits automated invoice processing stops the automation at one point: any change to a supplier's bank details. Route that change out of the automated flow to a callback on a known number and two approvers. Keep the email check in front of it, since the request arrives from a real supplier account that passes authentication. Let matching and payment run automatically only after the vendor file holds confirmed bank details.
The controls that matter most check a supplier once at onboarding and again at every change. At onboarding, Commerce Bank advises validating a new vendor's tax ID and business registration, along with its contact information and bank details9. After onboarding, treat a changed address or phone number as a red flag and confirm it on the number already on file. Keep the confirmed details in one vendor file that changes only with two approvals.
Invoice tracking software strengthens AP workflows by keeping a record that each payment can be checked against. Switching from manual systems to digital accounts payable and receivable systems creates a clear audit trail10. Use that trail to see when a supplier's bank details changed and who approved the change. It also makes a payment much higher than the typical invoice easy to spot.
Track three numbers. The first is bank change requests received by email, from the accounts payable log, with how many were confirmed by callback. The second is forwarding rules found and removed, from Get-InboxRule output in Microsoft 365 or the forwarding setting in Google Workspace. The third is the time from delivery to removal for each flagged message. A monitoring-mode test on your own mail gives a baseline for that third number.
They check each bank change request on its content, call back on a number already on file, and require two approvers. They also turn off automatic external forwarding in Microsoft 365 or Google Workspace. Authentication alone does not stop it, since a hijacked mailbox signs as itself.
Yes. A hijacked vendor mailbox signs as itself, so sender authentication passes. Criminals use what they gather inside compromised accounts to impersonate email with vendors. The request needs its own check.
User impersonation protection doesn't work if the sender and recipient previously communicated via email. A regular supplier has emailed you many times. The request needs a check against that sender's history.
In an AFP survey, 45% of companies were targets of vendor imposter fraud in 2024, up from 34% the year before. Business email compromise losses reported to the FBI reached $3,046,598,558 in 2025.
Yes. The option that lets users automatically forward incoming email is on by default. To turn it off, clear the Allow users to automatically forward incoming email box. In Microsoft 365, the outbound spam policy controls external forwarding.
Call your bank immediately for help addressing the payment. Then confirm with the real supplier on the number already on file. Check the mailbox that received the request for rules that forward to unknown addresses.
