Freight Forwarding Invoice Scam

This is a business email compromise style scam targeting companies that regularly use freight forwarders to manage the shipping, customs clearance, and warehousing of imported or exported goods. Fraudsters either compromise the freight forwarder's or the business's email account, or closely spoof the forwarder's email address, then send an invoice referencing a real or plausible shipment.

The invoice looks legitimate because it often references genuine shipment details, container or reference numbers, and the forwarder's real branding, sometimes because the fraudster has been monitoring email correspondence for some time before striking. The critical alteration is the bank account details, which are changed to an account controlled by the fraudster, sometimes accompanied by an explanation that the company has recently changed banks.

This scam is particularly damaging because freight invoices are often for substantial sums, and the payment is made by bank transfer, a payment method that is extremely difficult to reverse once it has cleared, especially across international borders.

The fraudster gains visibility into a business's shipping activity, either by compromising the email account of the business, the freight forwarder, or a related supplier, or by researching publicly available shipment or customs information. They then send an invoice timed to coincide with a genuine shipment that is already in transit or recently arrived, making the request feel entirely expected.

The invoice is designed to closely resemble the freight forwarder's real template, sometimes copied directly from a previous genuine invoice with only the bank details altered. The email may include a note explaining a recent change of bank, merger, or new payment processor to pre-empt any suspicion about the account details being different from usual.

The business, recognising the shipment reference and trusting the familiar branding, transfers the payment by bank transfer. Because international freight payments are often for large amounts and cross borders, the funds can be moved through several accounts very quickly, making recovery extremely difficult once the fraud is discovered, which is often only when the genuine freight forwarder later chases the same unpaid invoice.

The scam works because it exploits a real, ongoing business relationship and a genuine, verifiable shipment, which removes much of the doubt that a random unsolicited invoice would raise. Businesses handling frequent freight payments often have established habits of paying invoices promptly to avoid delays or storage charges on their goods, which the fraudster exploits by creating time pressure.

The explanation of a 'bank details change' pre-empts the one detail most likely to raise suspicion, and because freight forwarding relationships often involve multiple invoices and reference numbers, staff processing payments may not have a strong enough baseline to notice a subtly altered account number.

A small business owner who regularly imports goods receives an email that appears to come from their usual freight forwarding company, referencing a shipment that is genuinely in transit and attaching an invoice for freight charges, customs clearance, or warehousing fees. The email uses the freight forwarder's real logo and a plausible reference number, and the bank details on the invoice are only subtly different from the company's usual account, or the email explains that 'banking details have recently changed' due to an internal update. The business owner, trusting the familiar shipment details and pressed for time, pays the invoice by bank transfer. Days later, the genuine freight forwarder calls asking why an outstanding invoice has not been paid, and it becomes clear the earlier email was sent by a fraudster who had compromised or spoofed the forwarder's email correspondence, redirecting a legitimate payment into a criminal-controlled account.

Please note our bank account details have recently changed. Kindly use the updated details below for your outstanding freight invoice.

Invoice attached for shipment [reference number]. Payment is due within 48 hours to avoid warehousing charges.

Following our merger with a new payment processor, please direct all future payments to the account listed in the attached invoice.

Urgent: customs clearance for your shipment is pending payment of the attached invoice.

Always verify any change of bank details by phone, using a number obtained independently from the freight forwarder's official website or previous printed correspondence, never a number provided in the email itself. Confirm any invoice, especially one with new payment details, directly with a known contact at the freight forwarder before transferring funds.

Establish an internal policy requiring a second person to verify any change to supplier payment details, and consider making a small test payment first when paying a new or changed bank account for the first time, confirming receipt before sending the remaining balance.