Fake invoices and changed bank details: fraud between crewing agencies and shipowners
A shipowner receives an email that looks exactly like it came from their crewing agency: the same signature, the same thread, a real invoice — only the bank account is new. The money goes to criminals. This is called business email compromise, and the maritime industry, with its international payments and many parties, is a frequent target.
How it usually happens
- A mailbox is taken over. A password is stolen through a fake login page, and the criminal quietly reads the mail for weeks.
- A look-alike domain. The email comes from an address one letter different from the real one — easy to miss on a phone.
- The right moment. The fake message arrives exactly when an invoice is expected: crew change, wages, agency fees.
- Urgency. “Please pay today, the vessel is waiting”, “our old account is blocked by an audit”.
Warning signs
- A request to change bank details — by email only.
- A new bank in another country, or an account in a different name from the company.
- The sender’s address differs slightly from usual (check it letter by letter).
- Unusual wording, a different time zone, pressure not to call.
- Replies go to a different address than the one you wrote to.
The one rule that stops it
Any change of bank details is confirmed by a phone call to a number you already have on file — not the number from the email. The call takes two minutes; a wrong payment can cost a year of profit. Write this rule into your contracts and tell your partners about it in advance: then nobody is offended by the call.
Technical protection for the agency
- Two-factor authentication on every mailbox — first of all the managers who send invoices.
- Company email on your own domain with SPF, DKIM and DMARC — see why crewing emails land in spam.
- Alerts about logins from new countries and a regular check of mail forwarding rules (criminals often add a hidden one).
- Invoices as PDF from one known address, never “corrections” in the email body.
- A short briefing for staff: how a fake login page looks and what to do if they clicked.
If it has already happened
- Call your bank immediately — the sooner, the more chance to stop the transfer.
- Change passwords and sign out all sessions of the affected mailbox; check forwarding rules.
- Warn your partners that fake emails may come in your name.
- Report to the police and keep all emails as evidence.
How I help
I check the agency’s mail and domain, turn on two-factor protection, set up SPF, DKIM and DMARC, look for hidden forwarding rules and brief the staff. In Batumi I come to the office; for other cities — remotely. The price depends on the number of mailboxes and is agreed after the check. IT for crewing agencies →