Case Study: Stopping Fake Vendor Attack on Kuwaiti Trading Firm

Stopping the "Fake Vendor" Attack: How a Kuwaiti Trading Firm Blocked a KWD 15,000 Fraudulent Invoicen using Vircom

Dec 22, 2025

Industry: General Trading & Contracting

Region: Kuwait

Solution: Vircom (Proofpoint Essentials)

Focus: Invoice Fraud & Supplier Impersonation

The One Specific Issue: The “Changed Bank Details” Trap

A well-established General Trading company in Kuwait City imports materials daily from Europe and Asia. Their Accounts Department is busy, processing dozens of international wire transfers every week.

The threat wasn’t a virus. It was a fake invoice.

Hackers registered a domain that looked almost identical to one of the firm’s long-term suppliers (for example, supplier-kw.com instead of supplier.com).

They sent an email to the Accounts Team with a perfectly copied PDF invoice and a simple message:

“Dear Accounts Team, please note our bank details have changed for this month due to an audit. Please transfer the attached payment of KWD 15,000 to the new IBAN provided.”

Because the email contained no malicious links and no malware, the company’s legacy spam filter marked it as Safe.

The Risk: Bypassing the Human Eye

The Accountant opened the email. The logo was correct. The invoice number matched the Purchase Order. The language was professional.

The company was minutes away from transferring KWD 15,000 to a hacker’s bank account abroad.

The Core Problem

The Problem: Traditional filters check for “junk,” not for lies.
The Vulnerability: A busy employee cannot spot a fake domain that differs by a single, silent letter.

The Fix: Vircom (Proofpoint) Threat Intelligence

The company had recently upgraded their email security to Vircom (Proofpoint Essentials).

Unlike standard filters, Vircom deployed Proofpoint’s enterprise-grade MLX™ technology to analyze the DNA of the email.

The system did not just read the text. It analyzed the sender’s reputation using global threat intelligence.

How the Vircom (Proofpoint) engine caught the fraud:

Impersonation Defense: Detected a look-alike domain designed to trick the recipient.
Sender Reputation: Identified that the sender had no communication history with the company despite claiming to be a regular supplier.
Automatic Quarantine: The email was flagged as “Suspected Phishing” and blocked before reaching the Accountant’s inbox.

The Outcome: Disaster Averted

Money Saved: KWD 15,000 payment prevented
Zero False Positives: Legitimate supplier emails continued without disruption
Global Protection: Real-time updates from Proofpoint’s global threat intelligence database