threats

Vendor Email Compromise (VEC)

Updated October 16, 2026

Vendor email compromise (VEC) is fraud that exploits trust in a supplier or business partner, often by using a compromised vendor mailbox to insert deceptive requests into real communication. Related vendor-impersonation attacks may use separate addresses instead. In either case, a known relationship can make fraudulent payment instructions unusually persuasive.

2 min. read

What do I need to know about Vendor Email Compromise (VEC)?

Correct invoice details and an existing thread do not validate a change in payment destination.
A real vendor account can pass email authentication while being misused.
The recipient organization may lack visibility into the vendor’s sign-in logs, making independent process checks especially important.
Coordination with the vendor should use a known channel outside the possibly compromised conversation.

An illustrative example

A supplier’s mailbox sends a genuine invoice followed by an “updated banking” notice. Your team cannot inspect the supplier’s identity logs, but it can pause the change, call a verified finance contact, and check whether other employees received the same instructions. Evidence gaps at the vendor do not require abandoning your own payment controls.

Practical checks

Validate payment changes through established vendor records and the normal approval process.
Preserve the conversation and notify the vendor through an independently verified route.
Search related internal messages and transactions, and track both the financial outcome and the vendor’s account-containment status.

Five FAQs about Vendor Email Compromise (VEC)

Is VEC the same as BEC?

VEC is a vendor-focused form of business email fraud. BEC is the broader category and can involve executives, employees, customers, or other business identities.

Can a vendor email be fraudulent even if the address is correct?

Yes. A compromised real mailbox can send it. Treat the requested change and independent verification as separate from the address check.

Can our DMARC policy stop a compromised supplier?

Your policy governs use of your own domain. A supplier’s legitimate account may authenticate correctly under its domain while carrying a fraudulent request.

What if the vendor confirms the request by replying?

A reply through the same mailbox may still be controlled by the attacker. Use a contact route already verified outside that conversation.

What should we ask a vendor after an incident?

Ask which communication channels are safe, what dates and messages may be affected, and whether unauthorized access has been contained. Share necessary evidence through agreed secure channels without demanding unrelated personal information.