How does purchase-order impersonation differ from invoice redirection?
The impersonator acts as the buyer and persuades a seller to release goods, often before payment is due. Review the buyer connection, order, credit decision, and delivery destination before dispatch; a realistic purchase order does not establish those facts.
A realistic purchase order can persuade a seller to ship goods before anyone pays. If the named buyer never placed the order, the seller may discover the fraud only when the invoice comes due.
Purchase-order impersonation puts the seller’s shipment at risk before a payment arrives. Verify the buyer, order, credit approval, and delivery address before dispatch.
The attacker is pretending to buy from you
In March 2023, the FBI warned that criminals were impersonating businesses to acquire goods from US vendors. The advisory described misleading email identities, fake credit references and tax forms, and Net-30 or Net-60 terms that allowed additional orders before payment was due. Vendors could discover the fraud only after trying to collect or contacting the real company. FBI: commodity acquisition through BEC
This is one form of business email compromise, a term that covers deceptive business correspondence as well as misuse of genuine accounts. It does not require the seller to change bank details. The impostor wants the seller to deliver something of value on the strength of a false commercial relationship.
The GSA Office of Inspector General describes a related government-impersonation pattern. A false request for quotation leads to a realistic-looking purchase order, with contact details that lead back to the fraudster. Goods are directed to accessible commercial addresses, and the supposed agency later has no record of the procurement. GSA OIG: fake requests for quotations
A request for quotation, or RFQ, asks a seller for price and terms. A purchase order, or PO, records a proposed purchase from the buyer’s side. Neither a familiar logo nor the existence of a document establishes that the named organization issued it. “Net-30” and “Net-60” generally refer to payment due after 30 or 60 days under the agreed terms; confirm the actual starting point and conditions in your own process.
Our supplier bank-change article concerns money leaving a buyer. Here, the organization being targeted is the seller, and the immediate boundary is release of goods.
Follow the order across three desks
Sales receives the request and may establish the customer record. The credit owner decides whether and on what terms the customer may buy before payment. Fulfillment acts on the delivery instruction. Your company may combine those roles, but the questions still need separate answers.
| Review question | Evidence to connect to the order |
|---|---|
Is this request connected to the named buyer? |
Established buyer contact and independently obtained verification basis |
Does the buyer recognize this specific order? |
Item, quantity, order reference, and responsible purchasing contact |
Who approved the payment terms? |
Credit owner and documented decision under company procedure |
Where are the goods approved to go? |
Delivery destination and the basis for accepting it for this order |
What is fulfillment permitted to release now? |
Current order version and release instruction |
A credit decision based on unverified references can inherit the same false identity that persuaded sales. Likewise, a warehouse can accurately ship to an address that nobody established was appropriate for the buyer.
The FBI recommends contacting a business through its main telephone line rather than numbers supplied in the suspect correspondence. Apply that principle through your buyer-verification procedure. The callback contact-source guide helps you document where the contact came from. FBI verification guidance
Before the goods leave
Proposed release record
- Buyer and specific order
Independently connect the buyer to the recognized order and quantity.
- Credit decision
Identify the responsible approval owner, terms, and supporting basis.
- Delivery destination
Confirm approval for this order version. Changes return to the owner.
- Authorized dispatch
Resolve every dependency first. Name the release owner and current order.
Future payment collection cannot validate an earlier shipment decision.
Reapprove a changed destination
Confirming that a company exists does not establish that the correspondent represents it or placed this order. Credit approval does not resolve an unverified buyer identity.
Before dispatch, compare the current delivery instruction with the approved order version. If the destination changed, preserve both versions and obtain the required approval. Sales owns verification of the specific order; the designated delivery-change owner must resolve the new destination. Fulfillment needs their decisions before releasing the goods.
The release note should say what is still unresolved and who must decide. That allows a legitimate customer to complete verification without silently extending the original approval to a new address.
An unusual delivery address needs checking
The GSA warning identifies storage sites, warehouses, and freight forwarders in observed fraudulent shipping patterns. Those location types can also serve legitimate business purposes. Treat a changed or unusual destination as a reason to establish the order’s delivery basis, not as proof that its recipient is criminal. GSA OIG: shipping pattern
A legitimate order may have independent buyer confirmation, a documented credit decision, and an authorized temporary delivery site. The release procedure should explain how that order can proceed. If the process can only hold shipments indefinitely, it has not solved the operational problem.
This is also why grammar, urgency, or an impressive signature should not be the principal test. A convincing message can still lack an authenticated buyer connection, while a legitimate new customer may need an unfamiliar delivery arrangement. Review the facts that authorize this release.
Review what the warehouse actually received
Compare the sales record with the instruction available at dispatch. Did the shipment team see the approved destination and order version, or only “customer cleared”? Could someone change the address after approval without the change becoming visible? Who owns an urgent exception?
Answer those questions from the actual workflow. A tabletop can show that participants identify a missing approval. It does not establish that an order-management system technically blocks dispatch. If the business wants that separate check, use an authorized sandbox and dummy records with the application owner. Do not create a real order, credit account, carrier label, or shipment merely to make the discussion realistic.
If a real suspicious shipment has already left, escalate promptly through the organization’s fraud or incident process so the responsible team can coordinate with fulfillment and the carrier. Preserve the order, correspondence, destination changes, and dispatch record. Do not promise recovery: the outcome depends on where the goods are and what action is available. The FBI advisory provides reporting guidance for suspected BEC. FBI reporting
