Have you noticed an increasing number of your manufacturing contacts reporting compromised email accounts or sharing that their business has fallen victim to a scam? It’s no surprise: manufacturing has become the most targeted sector for cybercriminals, largely due to its critical role in the supply chain and the sensitive nature of its operations. And as email scams become ever more sophisticated, manufacturers and business owners are struggling on a daily basis to detect fraudulent activity.
Now, an elaborate new purchase order scam has emerged to add to the growing list of damaging cyber threats industrial companies need to watch out for. Today, we’re taking a closer look at this and other scams manufacturers should know about—before it’s too late.
Business Impersonators: The Purchase Order Scam from Hell
First up, let’s take a look at the purchase order scam mentioned in the above. Fraud schemes that impersonate prominent businesses and government entities remain among the most frequently reported scams to the FTCs Consumer Sentinel Network. In fact, in 2023 alone, the FTC recorded over 330,000 instances of business impersonation scams, highlighting the widespread impact of this issue across various sectors.
The purchase order scam is a sophisticated business impersonation scheme that operates on a global scale and involves multiple players with the end result of manufacturers unknowingly shipping goods to fraudulent entities.
In this scam, fraudsters will register corporate domains that closely resemble legitimate company websites. These scam domains are often off by a single character or look nearly identical to the real thing, making it easy for unsuspecting businesses to fall victim. For instance, an email address like info@company-name.com might be spoofed as info@compnayname.com, which can easily go unnoticed in a hurried work environment.
This subtlety allows scammers to exploit the trust established by the legitimate business. In many cases, their emails appear professionally crafted, complete with logos and other branding elements that mimic the real company’s communication style.
One red flag to watch for is that these domains often use an Anonymous Proxy VPN, which allows scammers—typically operating from overseas—to make it seem as though they're using a U.S.-based IP address. This tactic adds a layer of deception, making it harder for victims to detect any foul play.
When you visit these fraudulent websites, another warning sign might appear: instead of a fully functional corporate website, you'll often encounter a generic "coming soon" or "default" page. This can indicate that the domain was quickly set up with the sole purpose of conducting scams, although not all fake domains will display these placeholders.
The scam itself usually revolves around fraudulent purchase orders (PO) or NET30 terms, where the scammer impersonates a legitimate business and targets a supplier. They provide real company details, so when the unsuspecting supplier ships the goods, they send the bill to the actual company, which has no knowledge of the transaction. By the time the supplier realizes what has happened, the goods are already delivered to a storage facility or fractional warehouse, where scammers use intermediaries—often unaware they are aiding a scam—to repackage and re-ship the items.
For instance, let’s say you're a supplier of specialized machinery parts. One day, you receive a purchase order from what appears to be a well-known company in your industry, complete with professional branding and a detailed request for a large batch of parts, along with NET 30 payment terms. A big order, great!
The order looks legitimate; the email communication is polished and includes the company’s logo, which adds to its credibility. And so believing this is a standard transaction, you proceed to fulfill the order, shipping the parts to an unfamiliar warehouse address provided in the order. Only after the shipment is made do you realize that the order was fraudulent when the actual supplier contacts you about the bill. By that time, the scammers have already used intermediaries to repackage and ship your goods elsewhere, leaving you with significant financial losses and a damaged reputation.
To avoid falling victim, manufacturers should always verify domain names closely, double-check any suspicious orders, and be wary of requests to ship goods to unfamiliar locations. Proper vigilance and robust communication protocols are key to preventing these costly scams. For a detailed look at this scam, check out the video below.
Unfortunately, this is not the only scam manufacturers need to be vigilant about. Let’s take a look at some other common scams plaguing the manufacturing industry today.
Business Email Compromise (BEC) Scams
In this scam, cybercriminals hack or spoof a high-level executive’s email account (such as the CEO or CFO) and send fraudulent requests to the finance or accounts payable department. These emails often request wire transfers to fraudulent accounts, claiming urgency to pressure employees into quick action. Sometimes, the scammers impersonate suppliers and send fake invoices, asking for payment on legitimate-looking goods or services. Manufacturers can prevent BEC attacks by implementing multi-factor authentication, verifying wire transfer requests through multiple channels, and training employees on how to spot phishing attempts.
Related to this is the vendor impersonation scam or invoice fraud. In this scheme, scammers pose as a legitimate vendor or supplier, contacting the company to update payment details for future invoices. They may use fake letterheads, invoices, or phone numbers to convince the company to change the payment information. Once the changes are made, payments are sent directly to the scammer’s account, leaving the manufacturer with the liability of unpaid bills. Regularly verifying any changes to vendor information, especially payment details, is crucial to avoiding this type of scam.
Similar to vendor impersonation, the invoice redirection scam involves fraudsters intercepting legitimate invoices and altering the payment information. They may use email hacking or phishing to gain access to the communication between manufacturers and their suppliers, changing banking details just before the payment is processed. By the time the scam is detected, payments have been sent to fraudulent accounts. Cross-checking payment details and following strict protocols for changes in banking information can help mitigate this risk.
Fake Shipping and Freight Scams
In the logistics industry, a new scam is targeting manufacturers and shippers. Fraudsters posing as legitimate logistics companies or freight brokers offer extremely low shipping rates to attract unsuspecting businesses. Once the goods are handed over, these scammers either disappear with the shipment or deliver it to unauthorized locations, causing significant financial and operational damage.
In other cases, the shipment might be "held hostage," with demands for additional payments before delivery. Manufacturers should verify the credentials of shipping companies and avoid too-good-to-be-true offers.
Phishing Attacks Masquerading as Suppliers
Phishing attacks are increasingly sophisticated, and in the manufacturing sector, they often take the form of emails that appear to come from trusted suppliers. These emails may include attachments or links that, when clicked, install malware on the company's system, giving the scammer access to sensitive data. Manufacturers should always verify any unexpected email attachments or links, especially from suppliers or partners, and ensure they have up-to-date security software in place.
Supply Chain Manipulation
This scam involves third-party manipulation of orders within the supply chain. Scammers infiltrate communications between manufacturers and suppliers, modifying orders to their advantage—either increasing quantities, rerouting deliveries, or swapping items. The unsuspecting manufacturer delivers the altered orders, which often results in financial losses. Manufacturers should ensure secure communication channels, encrypt sensitive data, and confirm order changes with verified contacts to prevent supply chain fraud.
By being aware of these scams and implementing robust verification processes, manufacturers can significantly reduce their exposure to these types of fraud, helping protect their supply chains and finances.
The IndustryNet Difference: Ensuring Trusted Connections Between Buyers and Suppliers
At MNI, our processes are backed by real human interaction and research, from the data we compile on the manufacturing sector that powers our industrial business profiles to the RFQ’s we field every day for our industrial marketplace IndustryNet. With IndustryNet, buyers can send multiple RFQ’s to qualified suppliers right through the platform, helping millions of buyers search and quote for free from 360,000+ U.S. industrial businesses to procure the parts, products and services they need to run their business. Each RFQ is manually verified by our quality control staff for legitimacy before it's approved and sent to our qualified suppliers, ensuring trusted connections between buyers and suppliers. Set up your free account and get quoting today!
