Fake Supplier Email Red Flags for Accounts Teams: 10 Signs Before You Pay
A supplier email asking to update bank details can redirect every future payment. Use these 10 red flags to protect your accounts-payable team.
Your accounts team receives an email from a regular supplier:
“Please update our bank details before processing Invoice #INV-2451 today.”
The supplier name is familiar.
The invoice number matches an open purchase order.
The attached bank letter looks official.
But if the email is fake, the mistake happens before anyone notices.
Vendor impersonation is a form of business email compromise in which an attacker poses as a real supplier, usually to redirect invoice payments to a new account. A single fraudulent bank-detail change can affect not only the current invoice, but every future payment to that supplier.serrala
Golden rule: A familiar supplier name is not verification. A PDF invoice is not verification. Verify every payment instruction through a trusted contact channel already stored in your vendor master.
Why Accounts Teams Are Targeted
Accounts-payable teams handle the exact information fraudsters want:
- Supplier invoices
- Purchase orders
- Payment approvals
- Bank-detail changes
- Vendor master records
- Payment-release permissions
Attackers may compromise a supplier mailbox, use a lookalike domain, or send a convincing email from a new address. They often target an active invoice shortly before its payment due date.serrala
10 Red Flags in a Supplier Email
1. Sudden bank-detail change
A supplier asks you to update bank details, especially close to a payment due date.
This is the most common invoice-fraud pattern. Treat it as high risk and pause the payment until it is verified.serrala
2. Urgency before the payment run
The email says:
text Please process today. Payment run closes soon. Do not delay.
Urgency is designed to prevent verification. An unexpected payment change deserves verification even if the email is polite and grammatically correct.
3. Request to skip approval
The sender says:
text Please do not inform accounts. This is confidential. Approve directly.
Requests to keep a payment confidential or bypass normal approval steps are major red flags.
4. Lookalike email domain
Check the actual sender address—not just the display name.
For example:
text supplier-group.com supp1ier-group.com supplier-group.co.in supplier-group-mail.com
A small spelling change or new domain can indicate impersonation.serrala
5. New contact person
The email comes from someone you have never dealt with before.
The sender may claim the usual contact is unavailable, has left the company, or is travelling.
A change from your usual supplier contact is a warning sign, especially when combined with a payment change.serrala
6. Reply-To address differs from sender
The “From” address may look correct, but the “Reply-To” address sends your response to a fraudster.
Check the full email header before replying. A mismatched Reply-To address is a common BEC signal.
7. Invoice details do not match records
Compare the invoice with your purchase order, contract, delivery note and prior payment history.
Look for:
- Missing purchase-order number
- Wrong amount
- Unfamiliar vendor address
- New bank account
- Unusual payment terms
- Invoice date that does not match delivery
Discrepancies between purchase orders, delivery notes and invoices are strong warning signs.medius
8. Multiple invoices below approval limits
You receive several invoices just below your approval threshold.
This can be an attempt to split a large payment into smaller approvals and avoid senior review.fiscaltec
9. New supplier sends a large invoice quickly
A recently onboarded vendor sends a large invoice soon after setup.
Be extra cautious if the vendor has incomplete contact details, no verifiable website or no clear business presence.serrala
10. Payment instructions come only by email or WhatsApp
The supplier refuses a callback and insists that everything must be handled by email, WhatsApp or a new phone number.
Payment instructions provided only through email, with pressure to avoid normal verification, are high risk.flagright
What To Do When You See a Red Flag
Step 1: Pause the payment
Do not update the vendor master.
Do not release payment.
Place the supplier in a “bank-change verification pending” status.
Step 2: Do not use contact details from the email
Do not call the number in the email, invoice, attachment or signature.
Do not reply to the email.
Do not click links or open unexpected attachments.
Step 3: Call the supplier through a trusted channel
Use a phone number already stored in your vendor master, signed contract or verified onboarding record.
Ask the supplier’s known authorised contact to confirm:
- Whether they requested the change
- The exact bank account and IFSC
- The authorised signatory
- The reason for the change
- Whether the email came from them
The callback should use an independently sourced number, never a number supplied in the suspicious request.serrala
Step 4: Record the verification
Maintain a vendor bank-change register with:
- Vendor name and code
- Date of request
- Requested bank details
- Person who made the request
- Person who verified it
- Trusted phone number used
- Date and time of verification
- Approval evidence
- Final decision
Step 5: Require dual approval
Use maker-checker approval:
text Maker → verifies and records the change Checker → independently approves the change Payment releaser → releases payment only after approval
No single employee should be able to change a supplier’s bank account and release payment alone.
How ScamShield AI Helps
ScamShield AI helps accounts-payable, finance and procurement teams review suspicious supplier communications before payment approval.
Forward the suspicious supplier email, invoice, GST notice, link, UPI ID or payment screenshot to ScamShield AI.
ScamShield AI helps identify fraud signals and gives your team a fast pay-or-stop risk assessment before the vendor master is updated or payment is released.
Before you update a supplier’s bank details, check the email with ScamShield AI.
FAQ
What is the biggest red flag in a supplier email?
A sudden request to change bank details, especially close to a payment due date, is the biggest red flag. Pause and verify through a trusted contact channel.serrala
Is a PDF invoice or bank letter enough proof?
No. Invoices, bank letters and attachments can be forged or sent from a compromised mailbox. Verify through a trusted phone number already stored in your vendor master.medius
Should we call the number on the invoice?
No. Use a number already stored in your vendor master, signed contract or verified onboarding record—not a number supplied in the suspicious email or attachment.serrala
What should we do if the supplier confirms the change?
Record the verification, obtain approval from a second authorised person, update the vendor master through controlled access, and monitor the first payment carefully.