Business Email Compromise and Bank Detail Fraud in Freight

Business email compromise (BEC) is fraud in which a criminal uses a hijacked or imitated email account to persuade someone to send money to the wrong bank account. In freight it usually arrives as a quiet, plausible message: a carrier, overseas agent or customer writes that "our bank details have changed" and attaches a real-looking invoice. The key takeaway is that this is a process failure, not a technology failure: the single most effective defence is a standing rule that no bank detail is ever changed on the strength of an email alone, backed by a call to a number you already held before the email arrived. It is a different crime from cargo theft, which is covered in our post on fictitious pickups and double brokering. Here the cargo is fine and the money is what disappears.

How much money is involved

The FBI's Internet Crime Complaint Center (IC3) publishes the most widely cited public figures. In its 2025 IC3 Annual Report, BEC accounted for 24,768 complaints and reported losses of $3,046,598,558, the second-largest loss category after investment fraud. The same table gives $2,770,151,146 for 2024 and $2,946,830,270 for 2023, so the figure has stayed near $3 billion a year for three years running. Dividing the 2025 loss by the complaint count gives an average of roughly $123,000 per complaint.

Two cautions on those numbers. First, they are complaints reported to the FBI, so they undercount unreported losses and are weighted to the United States. Second, IC3 does not break BEC out by industry, so nothing in the report says how much of that total is logistics. Treat any freight-specific percentage you see quoted elsewhere without a named source with suspicion. What the report does support is the pattern: the amounts per incident are large enough that one successful diversion can erase the margin on hundreds of shipments.

How BEC works in freight, step by step

There are two common mechanics, and they leave different clues.

• A compromised mailbox. The criminal gets into a real account, typically through a phishing page that harvested the password, and reads the correspondence quietly. TT Club, the transport mutual insurer, has described the pattern: the fraudster watches email traffic, waits until a payment is due, then sends the payer a message about changed bank details, sometimes while hiding the genuine reply from the real sender. Because the message comes from the genuine address, sender checks pass.
• A look-alike domain or address. The criminal registers a near-copy of the real domain (one character changed, a swapped letter, a different top-level domain) or sets up an address that is "an almost exact copy of the source email", in TT Club's words, and joins the thread. The conversation history is often real because the criminal has seen it.

Either way, the message reads like a normal operations email. It names the right shipment, the right invoice number and the right amount. The only thing that has changed is the account at the bottom.

Where it hits a freight business

Forwarders sit in the middle of several payment flows, which is why one inbox can be attacked from many sides.

The last row matters most for liability. TT Club points out that where goods are released against a false wire confirmation, the forwarder can face a claim because the cargo left without payment. A diversion that begins as a payment problem can end as a cargo claim.

Why logistics is an attractive target

The IC3 report gives no logistics breakdown, so this is reasoning about how the work is organised rather than a measured statistic. Freight has the ingredients that fraud needs:

• Many parties per shipment. Shipper, consignee, forwarder, agent, carrier, haulier, customs broker and terminal all email each other, so a new name or address in a thread rarely stands out.
• Large invoices and wire payments. Ocean freight, duty and demurrage invoices are big, and international payments are often wire transfers that are hard to reverse.
• Time pressure. Cargo is waiting, a detention clock is running, a sailing cut-off is near. Urgency is the criminal's best tool, and in freight it is believable.

Correcting three common assumptions

• "The email came from the right address, so it is real." If the mailbox itself was hijacked, it is the right address. Sender checks protect against forged senders, not against a genuine account in the wrong hands.
• "DMARC will stop this." DMARC, SPF and DKIM (described in the UK NCSC's email anti-spoofing guidance) make it harder for someone to send mail that falsely claims to be from your domain, and a DMARC policy of reject is the NCSC's recommended end state. They do not stop a look-alike domain that is a different domain entirely, and they do nothing about a compromised mailbox at your supplier. They protect your customers from fake "you" emails, which is worthwhile, but they are one layer.
• "The bank will get it back." Sometimes, but only if you move fast. See the section on the first hours below.

Controls that actually work

The FBI's own guidance and the UK fraud-prevention advice agree on the core: confirm changes to payment details through a second channel, using contact details you already held, not details supplied in the request. The FBI states it as using "secondary channels or two-factor authentication to verify requests for changes in account information", and UK advice is to check supplier detail changes directly with the company on a known number or in person. TT Club adds that you should delay payment until revised instructions are confirmed. Turn those principles into rules your team can follow without judgement.

1. A written rule that bank changes are never accepted by email alone. Put it in your accounts procedure, tell every supplier and customer, and print it on your invoices. The rule removes the argument "but it sounded urgent".
2. Call-back to a number held on file. The number must come from your onboarding record, a previous payment you know was genuine, or the company's own website that you looked up yourself. Never use the phone number in the email, the invoice or the signature, because those are exactly the details a criminal controls. This is why a good client onboarding checklist should capture a named contact, a phone number and bank details at the start, in a record the sender cannot edit by email.
3. Dual approval for any change. One person receives and records the request and a different person performs the call-back and releases the change. A control owned by one person can be talked past by one convincing caller.
4. Lock the vendor master file. Restrict who can edit payee details, log every change and review the log monthly. This is also where carrier packets and the details collected when vetting overseas agents belong, so that the file you pay from is the file you checked when the relationship began.
5. Multi-factor authentication on every mailbox. Most mailbox takeovers start with a stolen password. MFA on email, and on the accounting and banking systems, closes the commonest route in. Audit mailboxes for forwarding rules you did not create, which criminals use to keep reading after a password reset.
6. Protect your own domain. Publish SPF and DKIM, then DMARC, starting at a policy of none to monitor and moving to quarantine and reject as the NCSC's guidance describes. Consider registering obvious look-alike variants of your domain and watching for newly registered near-matches.
7. Check the account name, not just the number. Where your bank offers payee name checking (the UK's Confirmation of Payee is an example), use it. A mismatch is a stop signal. It is not a substitute for the call-back, because criminals open accounts in plausible company names.

The first hours after a fraudulent payment

Recovery depends on speed. The FBI's 2025 report says that if you discover a fraudulent transfer, "time is of the essence": contact your financial institution immediately and request a recall of the funds, along with any indemnification documents the bank requires, and file a complaint at ic3.gov regardless of the amount, including full transaction details. IC3 describes its Recovery Asset Team's Financial Fraud Kill Chain process, in which it works with banks and FBI field offices to freeze funds. For 2025 it reports 3,900 incidents of all fraud types, $1,163,919,846 in attempted theft and $679,013,183 frozen, a 58 percent success rate. That figure covers every fraud type the process handled, not BEC alone, and it is not a promise of recovery. It does show why hours matter.

1. Call your bank first, then confirm in writing. Ask for an urgent recall and ask what indemnity or paperwork they need. Banks differ in what help they give, so find out who to call before you need them.
2. Report to law enforcement the same day. In the United States, file at ic3.gov. In England, Wales and Northern Ireland, the Report Fraud service (reportfraud.police.uk, 0300 123 2040) replaced Action Fraud from 4 December 2025; in Scotland, call Police Scotland on 101. Elsewhere, use your national police cyber-crime or fraud reporting centre and check the current contact details.
3. Tell the real counterparty. The genuine supplier or customer needs to know their mailbox or identity is being abused, and they may have received other fraudulent instructions.
4. Lock down your own systems. Reset passwords on affected mailboxes, revoke active sessions, enforce MFA, remove unknown forwarding rules and ask your IT provider to preserve logs. Keep the fraudulent emails with full headers, the invoice and the payment confirmation, and delete nothing.
5. Notify your insurers promptly. Policies usually set notice conditions, and a late notice can complicate a claim.
6. Take legal advice on who bears the loss. Where a customer paid a criminal impersonating you, responsibility depends on the contract, the facts and the jurisdiction, and can be disputed. Do not admit liability or promise reimbursement before you have advice.

The insurance angle

Do not assume your existing cover responds. In our post on errors and omissions, cargo and legal liability cover, those policies respond to liability to others: a missed deadline, a damaged shipment, a customer's claim. A payment-diversion loss is typically your own money, or a customer's, paid to a criminal. Professional indemnity wordings commonly exclude fraudulent or dishonest acts, so it is not the natural home for this loss, and cargo cover does not insure payments. Read your wording and ask your broker directly.

The cover designed for this risk sits elsewhere, and it varies:

• Commercial crime policies can include social engineering or impersonation fraud cover, sometimes as an extension, and not every insurer offers it.
• Cyber policies often offer it as an optional insuring agreement with a lower sublimit than the main cyber limits.
• Verification conditions. Many wordings expect you to have followed a call-back or authentication procedure. Broker commentary warns that these provisions can limit or defeat a claim, so the controls above are also what keep the cover valid. Ask whether a callback condition applies and whether your actual practice meets it.

Insurance is a backstop for the money, not a substitute for the controls. It also does little for the customer relationship or for a released shipment, which is why the call-back rule sits in your standard terms and your credit procedures. Cover for non-payment by a genuine customer is a separate product, discussed in trade credit insurance and credit control for forwarders.

Fitting the rule into credit control

Payment-diversion fraud thrives where invoicing is informal. A disciplined credit control process already requires one trusted record of each customer's contact and bank details, one place invoices are issued from and a routine for chasing payment. That same discipline is what makes a changed bank account stand out. Add two lines to your standard terms: that bank details are only changed by a signed notice confirmed by call-back, and that payment to any account not confirmed this way does not discharge the invoice. Have a lawyer in your jurisdiction check that wording, because its effect varies. The same suspicion applies to any rushed letter of indemnity that arrives by email.

What to do next

1. Write the rule: no bank detail change on email alone, a call-back to a number held on file, and two people involved.
2. Tell every supplier, agent and customer about the rule and print it on your invoices and email footer.
3. Turn on multi-factor authentication for every mailbox and finance system, and audit mailbox forwarding rules.
4. Set up SPF, DKIM and DMARC for your domain, starting at monitoring and moving toward reject.
5. Ask your broker in writing whether you have social engineering cover, at what limit, and what verification conditions apply.
6. Write a one-page response plan with your bank's fraud contact, your national reporting channel and your insurer's notice line, so the first call takes minutes.

If you are checking a new counterparty before you pay them, you can search more than 29,300 logistics companies by country and service in the CargoLinked directory, and the public requests board lists freight that shippers have posted for forwarders to quote on directly. A directory listing is not a check on anyone's bank details: always confirm payment details through your own call-back.

This article is general information for freight forwarders and is not legal, financial, banking or insurance advice. Reporting channels, bank procedures and insurance wordings differ by country and provider. Confirm current contact details with the relevant police or fraud-reporting service, and take advice from your bank, your insurance broker and a qualified lawyer about your own situation.