Dressed in Your Vendor's Clothes: How Attackers Forge Trusted Business Notifications to Reach Your Inbox Unchallenged

There is a specific category of email that bypasses most people's skepticism almost entirely: the operational notification from a company you already do business with. A message informing you that your package has shipped, that your cloud storage is nearly full, or that your payment method needs to be updated does not trigger the same alarm response as an unsolicited offer or an unexpected prize notification. It feels like business correspondence — routine, expected, and legitimate.

That distinction in how recipients process different types of messages is precisely what a sophisticated class of phishing attacks is engineered to exploit. Rather than impersonating strangers, these campaigns impersonate the operational layer of your digital life: the payment processors, shipping carriers, software platforms, and financial institutions whose notifications you have been trained to act on promptly.

Why Vendor Impersonation Works Where Generic Phishing Fails

Standard phishing awareness training has made most people reasonably alert to obvious red flags: generic greetings, implausible offers, urgent threats from unfamiliar senders. The training is effective against unsophisticated attacks. It is considerably less effective when the attack is constructed to look indistinguishable from correspondence you routinely receive and act upon.

Vendor impersonation attacks succeed because they align with established behavioral patterns. If you receive a shipping notification from a carrier, you are accustomed to clicking the tracking link. If you receive a security alert from your cloud provider, you are accustomed to reviewing it promptly. The attacker's message is designed to fit seamlessly into that existing behavioral groove — arriving at the right moment, using the right visual design, and requesting an action that feels proportionate to the stated context.

Proofpoint's 2023 State of the Phish report found that impersonation of recognized brands was the dominant technique in successful phishing campaigns targeting US organizations, with cloud service providers, shipping companies, and financial institutions consistently ranking among the most impersonated categories. The effectiveness rates for these targeted impersonation attacks significantly exceeded those of generic credential harvesting attempts.

Anatomy of a Spoofed Supply Chain Notification

To understand how these attacks are constructed, consider a representative example: a campaign impersonating a major cloud infrastructure provider to target the employees of its business customers.

The attacker begins with open-source reconnaissance, identifying companies that publicly reference the target vendor in job postings, press releases, or technical documentation. This establishes which organizations are likely customers and therefore likely to receive genuine notifications from that vendor.

The phishing email is then constructed with considerable care. The sender domain may be a lookalike — a string of characters that closely resembles the legitimate domain when read quickly, such as substituting a numeral for a letter or appending a plausible-sounding subdomain. The email template replicates the legitimate vendor's visual identity precisely, including logos, color schemes, footer formatting, and the specific language the vendor uses in its routine communications. The pretext — a billing discrepancy, an expiring authentication certificate, a suspicious login requiring verification — is chosen to justify the requested action without raising proportionate suspicion.

The link embedded in the message routes through a legitimate URL shortener or a compromised website before landing on a credential harvesting page that mirrors the vendor's actual login interface. In more sophisticated variants, the page is served over HTTPS with a valid certificate, removing the browser security indicator that many users have been trained to treat as a trustworthiness signal.

Real-World Campaigns and Their Targets

In 2022, a campaign targeting users of Twilio, the cloud communications platform, demonstrated how precisely these attacks can be calibrated. Attackers sent SMS messages impersonating Twilio's IT department, directing employees to a spoofed login page. The campaign successfully compromised employee credentials, which were then used to access customer data — including, in a cascading breach, the systems of downstream customers who had integrated Twilio into their own products.

A separate campaign documented by researchers at Abnormal Security targeted accounts payable departments at mid-sized US companies with emails impersonating QuickBooks, the widely used accounting software. The messages replicated QuickBooks' standard invoice notification format and directed recipients to approve a payment through a spoofed portal. The attack did not require any technical sophistication from the victim — only the habitual compliance of someone processing a routine invoice.

Tax season produces a predictable surge in campaigns impersonating the IRS, TurboTax, H&R Block, and payroll platforms such as ADP and Paychex. The time pressure inherent in tax compliance — combined with the genuine complexity of tax software notifications — creates an environment in which even cautious users may lower their guard.

Verification Before You Click: A Practical Framework

The most effective defense against vendor impersonation attacks is the interruption of the reflexive response these messages are designed to trigger. Before acting on any notification that requests credential input, payment action, or software installation, the following verification steps should be standard practice.

Navigate independently, not through the message. If a notification claims to require your attention on a vendor platform, open a new browser tab and navigate to that platform directly by typing the known URL or using a saved bookmark. Do not use any link contained in the message. If the issue referenced in the notification is real, it will be visible in your account dashboard.

Examine the sender domain with precision. The display name of an email sender can be set to anything — "FedEx Delivery Notifications" proves nothing. The actual sending domain, visible in most email clients by expanding the sender field, is the relevant data point. Confirm it matches the vendor's known domain exactly, including any subdomains used for transactional mail, which legitimate vendors typically publish in their support documentation.

Treat urgency as a signal, not a directive. Legitimate vendors rarely require immediate action under threat of account suspension or data loss within hours. Artificial urgency is one of the most reliable indicators of a social engineering attempt. When a notification creates pressure to act before you can verify, that pressure is itself informative.

Contact the vendor through a verified channel. If a notification appears plausible but cannot be independently confirmed through the vendor's platform, contact the vendor's support team using a phone number or email address obtained from their official website — not from the notification in question.

Report suspicious messages to your organization's security team. In a corporate environment, a vendor impersonation attempt that reaches one inbox has likely reached others. Prompt reporting allows security teams to implement controls before other recipients act on the same message.

The Authentication Infrastructure Gap

On the technical side, email authentication standards — SPF, DKIM, and DMARC — exist precisely to prevent domain spoofing. When properly implemented by both the sending organization and the receiving mail server, these protocols make it substantially more difficult for an attacker to send mail that appears to originate from a legitimate vendor domain.

However, implementation remains inconsistent. A significant proportion of US organizations have not deployed DMARC at an enforcement policy level, meaning spoofed messages may still reach inboxes without triggering automated rejection. The Cybersecurity and Infrastructure Security Agency has recommended DMARC enforcement as a baseline security control, and organizations that have not yet implemented it should treat it as a priority.

For individual users, the gap in technical controls means that behavioral verification practices are not merely supplementary — they remain the last reliable line of defense against an attack class that has proven consistently capable of outpacing both automated filters and security awareness training.