---
title: "Near-miss vendor payment fraud: what controllers should do next"
description: "Someone almost paid a fake vendor bank change. What to check this week, the payment rules that stop the next one, and what to do in the first hour if money goes out."
url: "https://northcreektechnology.com/guides/vendor-payment-fraud/"
updated: "2026-10-13"
audience: "Controllers, CFOs, and owners"
author: "Andrew Healey"
publisher: "Northcreek Technology"
---

# After a near-miss on a fake vendor payment

A near-miss on a fake bank change is a free warning. This week, find out how the attacker got the details, write down one verification rule, and put your bank's fraud number where accounts payable can see it.

The email looked right. It came from a vendor you pay every month, in a thread you'd seen before. It said their bank had changed and attached new account details on their letterhead. Someone in accounts payable thought it looked a little off and asked. That question saved the payment.

This is called business email compromise, or BEC. The FBI's Internet Crime Complaint Center (IC3) received 24,768 complaints about it in 2025, with reported losses of just over $3 billion. Those are only the ones that got reported.

## This week: find out how it happened

**Check the sender address.** Look at the full email address, not the display name. Is it one letter off from the real domain? A look-alike domain means the attacker is outside both companies.

**Call the vendor, using a number you already had.** Not the one in the email. Tell them what you received. If the email came from their real address, their mailbox may be compromised and they need to know. They may have sent the same thing to other customers.

**Ask your IT company to check your own mailboxes.** The attacker knew about the invoice, the timing, and the thread. Ask IT to look for forwarding rules or inbox rules nobody set up (attackers use them to hide replies), sign-ins from unusual places, and any account without multi-factor sign-in (MFA, a code or prompt on your phone at login).

**Write down what happened.** Date, the email, who caught it, and what they noticed. You'll use it to train others, and your insurer may ask about it.

## The rules that stop the next one

None of these need new software.

1. **Any change to a vendor's bank details gets a phone call** to a number already in your vendor file, from before the request. Never use a phone number, link, or form from the email asking for the change.
2. **A second person approves** bank detail changes and payments over an amount you set. Make sure the same rule covers ACH payments, not just wires.
3. **Nobody bypasses the rule because it's urgent.** Urgency is the attacker's main tool. The owner and the CFO follow the same rule.
4. **Hold the first payment to new bank details** for a day or two when you can, and confirm with the vendor that it arrived.
5. **Ask your bank** what fraud tools you have. Many offer dual approval in online banking. Some offer positive pay, where the bank checks each check you wrote, and each company pulling money from your account, against a list you approve. It guards against forged checks and unauthorized withdrawals, not payments you send yourself.

Write these on one page, have the owner sign it, and walk accounts payable through it. Your cyber insurance application probably asks about it. See [is your cyber insurance application true?](/guides/cyber-insurance-application/)

## If money goes out: the first hour

The FBI's guidance is plain: time matters most.

1. **Call your bank's fraud line** and ask them to recall the payment. Have the date, amount, and account details ready.
2. **File a complaint at [ic3.gov](https://www.ic3.gov)**, whatever the amount. Include the full transaction details. The FBI's Recovery Asset Team works with banks to try to freeze funds, and it can only act on what's reported.
3. **Call your insurance broker.** Your policy may have a notice deadline, and the insurer may want to choose who investigates.
4. **Don't delete anything.** Keep the emails and logs for the investigation.

Put the bank's fraud number and these four steps on a card at the accounts payable desk. The worst time to look up a phone number is during the call.

## Practice it once

A one-hour talk-through with the owner, the controller, accounts payable, and the IT company finds the gaps before an attacker does. Walk through a fake bank change and a taken-over executive mailbox, and decide who does what. That's one of the two practice runs in our Incident Readiness project.

Sources: [FBI Internet Crime Complaint Center, 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf).

## Questions

### Isn't this an IT problem?

Partly. IT can check the mailboxes and tighten email security. But the control that stops the payment, a phone call to a number you already had, belongs to finance. That's why it gets missed when everyone assumes the other side owns it.

### Does MFA on email prevent this?

It helps, because it makes it harder to take over your mailboxes. It doesn't stop a fake email from a look-alike address, and it doesn't protect your vendor's mailbox. The phone call does.

### What if the money already went out?

Call your bank's fraud line right away and ask them to recall the payment. Then file a complaint at ic3.gov, whatever the amount, and call your insurance broker. Speed matters more than anything else.

## Related guides

- [Is your cyber insurance application true?](https://northcreektechnology.com/guides/cyber-insurance-application.md)
- [How to tell if your IT company is doing a good job](https://northcreektechnology.com/guides/evaluate-your-it-company.md)
- [How to answer a customer security questionnaire honestly](https://northcreektechnology.com/guides/customer-security-questionnaire.md)

## Where Northcreek Technology fits

Incident Readiness (Incident response plan and tabletop exercises): Who decides what in the first two hours of a cyber incident. A two-page plan, a call list, and two practice runs with your team. https://northcreektechnology.com/services/incident-readiness/

## Next step

Book a call: https://northcreektechnology.com/contact/