VEC: Vendor Email Compromise
When the attacker poses as your supplier, your service provider or your long-standing partner.
What are we talking about exactly ?
Vendor Email Compromise (VEC) is a variant of BEC that targets the supplier chain. The attacker compromises or imitates a business partner's mailbox to divert a payment or inject a fake invoice.
Its strength: the history of legitimate exchanges genuinely exists.
How it works
- 1Supplier compromise
The attacker gains access to a salesperson's or accountant's mailbox at your supplier.
- 2Silent observation
They read real exchanges for weeks, identifying ongoing contracts, tone and habits.
- 3Injection at the right moment
Just before a major invoice, they send a message from the real address, or a near-identical one, to change the IBAN.
- 4No technical alert
The domain is legitimate, the tone is normal, so is the context. Nothing triggers an alert.
What the data tells us
Concrete examples
A firm receives a request to change IBAN from the main contractor, 3 days before an €80k deposit is due. The request comes from the real, compromised mailbox.
A recurring IT provider sends a slightly different annual invoice with new bank details. The trusting CFO approves it.
What works, and what falls short
- Spam filters: the email comes from a legitimate domain, so they don't catch it.
- Recognising the sender's name: strictly identical to usual.
- Strict procedure: no bank detail changes without phone validation on a known number.
- Identity signature on the supplier side: if it disappears or changes, that's a warning sign.
How STEGA TRUST responds to this threat
When your suppliers and partners are themselves signed with STEGA TRUST, the badge disappearing from a usually signed email becomes an explicit warning sign.
STEGA TRUST creates a verifiable trust chain between organisations, without changing reading habits.