Question 1

What is a vendor banking-detail BEC attack?

Accepted Answer

It is a targeted business email compromise where attackers impersonate a known supplier and request a change to the vendor's banking record. The goal is to redirect a real upcoming payment - an invoice the AP team is already preparing to pay - into an attacker-controlled account. Because the invoice and amount match the real upcoming payment, this class of attack is far harder to spot than a generic CEO-impersonation wire request. The FBI consistently lists supplier-impersonation BEC among the most financially damaging cybercrime categories.

Question 2

Why is the contact information inside a suspicious email unreliable for verification?

Accepted Answer

If the message itself is fraudulent, the phone number, reply-to address, and signature inside it are part of the same attack. Calling the number leads to the attacker. Replying to the email lands in the attacker's inbox. The attacker controls every channel they offered. The only reliable verification uses contact information that was established and stored separately from the request - typically a procurement-vetted vendor directory, a signed contract, or contact info exchanged in person.

Question 3

What does an authoritative vendor directory look like in practice?

Accepted Answer

It is a single source of truth for vendor identity, kept under separate control by the Procurement team and updated on a defined cadence. For each vendor it records the verified account manager, verified phone, verified email, mailing address, banking on file, banking change history with timestamps and approvers, and active contracts or invoices. Crucially, the directory shows when each piece of information was last verified and who approved it. AP, Finance, and Procurement all use the same record so there is no ambiguity about which contact details are authoritative.

Question 4

Why does a banking change history matter when verifying a request?

Accepted Answer

An email can claim anything - that the vendor's bank was just acquired, that the account number was rotated, that an old account is closing this week. The procurement record cannot. If the directory shows the bank on file has been unchanged for two years and no formal change request is open, the email's story directly contradicts the procurement record. That contradiction is one of the strongest signals available that the request is fraudulent.

Question 5

What is a formal change-request process and why does AP need one?

Accepted Answer

A formal change-request process requires every banking-detail change to flow through Procurement, where the request is logged, verified out-of-band, and approved by a named owner before AP can act on it. It removes AP as a single point of failure: even if an attacker convinces an individual AP coordinator, the change still cannot move forward without a separate procurement approval that requires verified-channel contact with the vendor. Companies with strong vendor BEC defenses share this pattern across the industry.

Question 6

Should I report a suspected BEC attempt even if I caught it before any money moved?

Accepted Answer

Yes, and especially in that case. The indicators in the message - sender domain, spoofed phone, attacker-controlled account number, signature pattern - let the security team pivot to find other employees who received the same campaign, feed downstream blocks to the email gateway, and share intelligence with industry sharing groups so other companies can pre-warn their AP teams. A clean catch in your inbox is exactly the kind of high-quality signal the SOC needs to protect everyone else.

Процедури перевірки

Що таке Процедури перевірки?

Що ви дізнаєтесь у Процедури перевірки

Процедури перевірки — Кроки навчання

Тихий ранок четверга

Електронний лист від Cascade Heavy

Читання запиту

Політика перевірки CypherPeak

Відкрийте VendorVerify

Увійдіть у VendorVerify

Пошук продавця

Відкрийте запис постачальника

Порівняйте перевірений телефон

Порівняйте банківську історію