--- title: "The Multiplying Effect of Vendor Email Compromise | Phish Protection" description: "The Multiplying Effect of Vendor Email Compromise: By now, most people know about the potential threat from business email compromise or BEC . With BEC." image: "https://phishprotection.com/og/blog/the-multiplying-effect-of-vendor-email-compromise.png" canonical: "https://phishprotection.com/blog/the-multiplying-effect-of-vendor-email-compromise/" --- Quick Answer By now, \_most people know about the potential threat from business email compromise or\_\_ \[BEC\](https://www.trendmicro.com/vinfo/us/security/definition/business-email-compromise-(bec))\_. With BEC, someone in a company gets their email taken over by a hacker and the hacker uses the trust implied in that email to exploit others in the company. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fthe-multiplying-effect-of-vendor-email-compromise%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=The%20Multiplying%20Effect%20of%20Vendor%20Email%20Compromise&url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fthe-multiplying-effect-of-vendor-email-compromise%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fphishprotection.com%2Fblog%2Fthe-multiplying-effect-of-vendor-email-compromise%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fthe-multiplying-effect-of-vendor-email-compromise%2F&title=The%20Multiplying%20Effect%20of%20Vendor%20Email%20Compromise "Share on Reddit") [ ](mailto:?subject=The%20Multiplying%20Effect%20of%20Vendor%20Email%20Compromise&body=Check out this article: https%3A%2F%2Fphishprotection.com%2Fblog%2Fthe-multiplying-effect-of-vendor-email-compromise%2F "Share via Email") ![Phish Protection blog post image](https://media.mailhop.org/phishprotection/images/2019/11/how-to-prevent-phishing-1991.jpg) By now, _most people know about the potential threat from business email compromise or_\_ [BEC](https://www.trendmicro.com/vinfo/us/security/definition/business-email-compromise-%28bec%29)\_. With BEC, someone in a company gets their email taken over by a hacker and the hacker uses the trust implied in that email to exploit others in the company. “_Formerly dubbed as Man-in-the-Email scams, BEC attackers rely heavily on **social engineering** tactics to trick unsuspecting employees and executives. Often, they impersonate the CEO or any executive authorized to do wire transfers._” As bad as BEC is, at least it threatens just a single company - the one with the compromised email. Not being satisfied with exploiting just a single company, hackers are now taking their game to a whole new level. _There is now evidence of hackers using that single email at the compromised company to exploit many companies - the companies in the compromised company’s supply chain_. It makes sense, too. It’s just as easy to trust an email from an employee as one from a trusted supplier or customer. It’s called **_Vendor Email Compromise_** (VEC) and it’s becoming a very large problem. According to Agari research, as reported by [Security Week](https://www.securityweek.com/vendor-email-compromise-latest-identity-deception-attack), “One of the most significant emerging threats in the cyber threat landscape is vendor email compromise. The key to these attacks is gaining access, through standard phishing, email accounts belonging to key individuals within a company’s accounts receivable or finance department. _The process is slower and demands greater patience from the attacker than typical BEC attacks, but can generate greater reward_. ![How to prevent phishing](https://media.mailhop.org/phishprotection/images/2019/11/how-to-prevent-phishing-1991.jpg) By first compromising one email account the attacker can slowly **compromise others**. The data found within the emails allows the attacker to learn how the company operates, and when things happen. In particular, attackers are looking for invoice and payment patterns with an important customer. The attacker gains an understanding of a vendor’s invoicing times, processes, and customers. _This intelligence enables him to create emails that are so realistic that they are virtually undetectable_ \- and, since he has already compromised the email account, he can deliver his attack from a genuine rather than a spoofed email account. In theory, if the compromised company sends out multiple invoices to multiple customers at the same time, the scam could be perpetrated on multiple customers.” This type of “supply chain attack” makes it so that almost no emails can be trusted. From anyone - inside or outside an organization. It has a multiplying effect in that a single email compromised at a single company now threatens dozens (or hundreds) of other companies who have a relationship with that company. ![How to prevent phishing](https://media.mailhop.org/phishprotection/images/2019/11/how-to-prevent-phishing-1992.jpg) If VEC doesn’t scare you into protecting your organization, nothing will. And what is the fastest, easiest and most affordable way to protect your company from VEC and every other kind of **phishing attack**? Cloud-based **email security** from [Phish Protection](/). Phish Protection, with [Advanced Threat Defense](/products/advanced-threat-defense/), is a cloud-based, integrated, [email protection service](/) suite of services that stops phishing, malware, spam and spoofing. It sets up in minutes, comes with 24/7 live technical support and only costs pennies per employee per month. Try it free for 30 days. ## Topics [ Phishing ](/tags/phishing/) ![Brad Slavin](https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead across DuoCircle's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Protect your inbox from phishing attacks Real-time email security with 60-day free trial. No credit card required. [Start Free Trial](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection) [View Pricing](/pricing/) ## Related Articles [ Foundational 5m 0ktapus, Okta Breach Helps Attackers Launch Sophisticated Supply Chain Attacks Sep 5, 2022 ](/blog/0ktapus-okta-breach-helps-attackers-launch-sophisticated-supply-chain-attacks/)[ Foundational 4m 13 Spear Phishing Attacks Examples To Justify Investment For Phishing Prevention Solutions In Your Organization Aug 1, 2019 ](/blog/13-spear-phishing-attacks-examples-to-justify-investment-for-phishing-prevention-solutions-in-your-organization/)[ Foundational 4m All 14 centers of Kettering Health were affected by a massive ransomware attack, Major outage in the Ohio medical center May 23, 2025 ](/blog/14-centers-of-kettering-health-were-affected-by-massive-ransomware-attack-in-ohio-medical-center/)[ Foundational 4m 2021 Phishing Trends You Need To Be Wary Of Aug 2, 2021 ](/blog/2021-phishing-trends-to-be-wary-of/) ```json {"@context":"https://schema.org","@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"Phish Protection","url":"https://phishprotection.com","description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"The Multiplying Effect of Vendor Email Compromise","description":"The Multiplying Effect of Vendor Email Compromise: By now, most people know about the potential threat from business email compromise or BEC . With BEC.","url":"https://phishprotection.com/blog/the-multiplying-effect-of-vendor-email-compromise/","datePublished":"2019-11-08T10:09:54.000Z","dateModified":"2026-04-17T15:43:10.000Z","dateCreated":"2019-11-08T10:09:54.000Z","author":{"@type":"Person","@id":"https://phishprotection.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://phishprotection.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://phishprotection.com/blog/the-multiplying-effect-of-vendor-email-compromise/"},"articleSection":"foundational","keywords":"Phishing","wordCount":518,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/images/2019/11/how-to-prevent-phishing-1991.jpg","caption":"Phish Protection blog post image","width":1200,"height":630},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://phishprotection.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://phishprotection.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://phishprotection.com/foundational/"},{"@type":"ListItem","position":4,"name":"The Multiplying Effect of Vendor Email Compromise","item":"https://phishprotection.com/blog/the-multiplying-effect-of-vendor-email-compromise/"}]} ```