BEC fraud: vendor impersonation and bank account changes

Business Email Compromise (BEC) is the most costly financial attack on companies in Mexico and worldwide. The script is simple: criminals impersonate a known vendor — or compromise their real email — and send instructions to change CLABE or pay an invoice to a new account. Accounting processes payment because the email looks legitimate, the invoice matches, and urgency seems credible. Money goes straight to criminal accounts.

How vendor impersonation fraud operates

• They research the business relationship: names, usual amounts, payment frequency.
• Register a similar domain (proveedor-mx.com instead of proveedor.com.mx).
• Compromise the vendor's real email with prior phishing.
• Send modified invoice with new CLABE just before expected payment date.
• Apply pressure: 'if you don't pay today we lose the discount' or 'previous account blocked'.

Why companies fall

Payment processes are designed for efficiency, not fraud. If email comes from the usual contact, invoice has correct format, and amount is plausible, accounting approves. Nobody calls the vendor because 'we always pay this way'. BEC exploits that operational trust.

A CLABE change should never be processed just because it arrived by email — regardless of who sent it.

Controls that block BEC

1. Out-of-band verification: any account change confirmed by phone to the already registered contact, not the email sender.
2. CLABE whitelist: only pay to previously validated and registered accounts.
3. Dual approval: amounts above certain threshold require two independent signers.
4. Visual markers on external email: alerts when sender isn't from expected domain.
5. Periodic training: accounting and purchasing must know this specific script.
6. Intentional delay: wait 24 hours on account changes before executing payment.

Warning signs in vendor emails

Slightly different domain, CLABE change request without prior notice on another channel, unusual urgency, grammatical errors in previously impeccable emails, PDF invoices with metadata from different software, or instructions to pay an individual when it was always a business account.

What to do if you already paid a fraudulent account

Contact the bank in minutes — not hours. File a report, notify the real vendor (they may be victims too), document the fraudulent email, and check if internal accounts were compromised. Some cyber insurance policies cover BEC losses if you maintained basic controls.

Practical implementation for SMBs

You don't need a security department to start. A payment policy document, mandatory confirmation call, and 30-minute annual training significantly reduce risk. Automating alerts when email arrives with keywords ('new account', 'updated CLABE') adds another layer.

Integration with purchasing and ERP processes

BEC is best prevented when controls live in workflow, not in the accountant's memory. Configure your ERP or payment system to alert when vendor CLABE doesn't match registered one. Require signed confirmation attachment for bank detail changes.

Periodically audit email permissions: purchasing and accounting accounts are most compromised. Enable multifactor authentication on all corporate email and restrict automatic forwarding to external domains.

• Register vendor CLABE only after documented phone verification.
• Implement automatic ERP alerts for bank detail changes.
• Review email access logs if you suspect prior compromise.
• Consider cyber insurance with specific BEC coverage.

At Devson Labs we design anti-BEC controls, payment approval flows, and training for finance teams in Mexican companies. Schedule a conversation if you process vendor payments via SPEI and want to sleep better.