Lookalike vendor email that changes a payment
A lookalike email domain, not a hacked inbox, has been used to trick people into sending a large wire to the wrong place. Before any big payment or account change, call the vendor on a number you already have.
How it works
You or your office may already be expecting to pay a real vendor. An email arrives that looks like it came from that vendor and gives new wiring instructions or asks you to pay now. The sending address is only slightly different from the real one. In one 2026 example, Liberty, Texas lost about $600,000 on a single wire after a lookalike domain posed as a vendor the city really owed. Nobody had to break into the city's email for the trick to work. The reliable check is a call back on a known number before you send the money.
Red flags
- An email changes payment instructions, even a little.
- The sender's domain is a close lookalike of a company you already work with.
- The request is urgent and discourages a phone call.
- The amount is large, or the details do not match an invoice you already had.
What to do
- Do not send the wire or change payment details from the email alone.
- Call the vendor or payee on a phone number you already have, not a number in the email.
- If money was sent, contact your bank immediately and file a report at ic3.gov.
- Also report the incident at reportfraud.ftc.gov.
Where to report it
- reportfraud.ftc.gov — the FTC's report form.
- ic3.gov — the FBI's Internet Crime Complaint Center.