AT A GLANCE

CHALLENGES

A vendor's phone line and email address had been quietly compromised

Every call and email meant for the real contact was being intercepted and answered by an impersonator

The impersonation was convincing enough that nothing about the communication itself raised suspicion

BENEFITS

Vendor impersonation identified before any funds moved

Client's real vendor relationship restored on a confirmed, trustworthy contact

Confidence that Plumb's verification process holds up even against sophisticated fraud

Objectives

When our client’s vendor communications were quietly hijacked, the situation called for more than a quick phone check. The priority was to confirm who was actually on the other end before honoring any instruction, without alarming the client or disrupting the underlying vendor relationship.

• Confirm vendor payment instructions through more than one independent source before acting on them
• Identify the point of compromise without disrupting the client’s underlying vendor relationship
• Prevent any funds from moving until the true identity of the contact was verified
• Determine how far the compromise extended before treating any instruction from that vendor as safe to act on
• Preserve the client’s ability to continue working with the legitimate vendor once his identity was reestablished

Solutions

Plumb’s standard protocol never treats a single channel as proof of identity, no matter how convincing that channel sounds. When something about this vendor’s responses didn’t add up, that protocol became the client’s first line of defense.

• Confirmed vendor instructions with a trusted contact: verbally, by email approval, or by app approval, depending on the vendor’s preference
• Layered on additional confirmation methods when something still felt uncertain after the first check
• Declined to accept reassurance from the same phone number and inbox already in question
• Engaged the client directly and obtained an independent, personal point of contact for the vendor representative
• Recognized that a consistent, responsive voice on the line was not, by itself, evidence of a legitimate identity
• Held the account and any pending instructions in place until the real contact could confirm what had happened

OUTCOMES

The impersonator had been answering calls and emails convincingly enough that nothing about the communication itself raised suspicion, yet no payment was ever issued on the strength of that contact alone.

• The vendor impersonation was identified before it could progress into a redirected payment or account change
• No funds were ever at risk throughout the incident
• The client’s real vendor relationship was restored on a confirmed, trustworthy contact
• Reinforced that no single channel, phone or email, is ever sufficient proof of identity on its own
• Confirmed Plumb’s standard verification protocol functions as intended when a vendor’s communication channel is compromised