A vendor your company uses changes banks. Their next invoice includes new payment instructions. Or, a supplier asks you to update its mailing address.
For most businesses, these are ordinary administrative requests. For fraudsters, they’re opportunities.
Instead of trying to hack through sophisticated cybersecurity defenses, criminals are increasingly exploiting the everyday processes employees already trust. By impersonating a familiar vendor or gaining control of a legitimate vendor account, an attacker can make a fraudulent change look like business as usual — and redirect money before anyone realizes something is wrong.
Familiarity Is Becoming a Vulnerability
One of the biggest challenges with modern business fraud is that messages may not look suspicious.
Abnormal AI’s 2026 Attack Landscape Report analyzed nearly 800,000 email attacks across more than 4,600 organizations and found that 61% of business attacks that involved email compromise was vendor-related.
Attackers are increasingly mimicking legitimate workflows and trusted business relationships instead of relying on obvious phishing tactics.
A closer look at Abnormal’s vendor email compromise research highlights several common approaches, including invoice inquiries, payment questions, and requests to update billing accounts. Particularly concerning: billing-account-update scams had the highest rate of attackers using an actually compromised vendor account rather than simply impersonating one.
That means checking the sender’s name or email address may not always be enough.
Case Study: One Change Can Cost Nearly $190,000
A recent incident in Harpswell, Maine, shows how quickly the damage can escalate.
In May 2026, town employees received fraudulent payment instructions made to appear as though they came from a legitimate vendor. According to the Harpswell Anchor’s original report, employees followed those instructions and $189,199 was diverted to the fraudster.
The consequences continued long after the transaction.
An August 2026 follow-up reported that the stolen money was unlikely to be recovered, legal costs were accumulating, and the town and vendor were discussing how to divide the loss. The town’s cyberfraud insurance reportedly wouldn’t cover it.
It’s a powerful reminder that the cost of fraud can extend well beyond the initial transaction.
Process Updates Needed: Important Changes Must Trigger Verification
Businesses don’t have to treat every vendor request as suspicious. They do need processes that prevent one convincing message from becoming one expensive mistake.
Requests involving new payment instructions, mailing addresses, or banking information should trigger independent verification. Employees can confirm changes through contact information already stored in company records rather than relying on a phone number or link supplied with the request. Organizations can also require secondary approval before significant payment information is changed.
Employee awareness is another important layer. Fraudsters rely on familiarity, urgency, and trust because those techniques work both inside and outside the workplace.
Giving employees tools and education to recognize identity fraud in their personal lives can complement stronger verification practices within the organization.
The goal isn’t to make routine business harder. It’s to make one simple question routine, too:
Before we redirect something valuable, have we verified who’s asking us to do it?
LibertyID Business Solutions offers customer information security protocols, information security training, third-party vendor management, and post-breach response services—helping businesses protect consumer data and meet the FTC Safeguards Rule and state compliance requirements. The package also includes our gold-standard identity fraud restoration services for employees and their families.