The Invoice Fraud Pattern That Keeps Hitting Manufacturers

A metal fabrication shop in Hialeah wired $87,000 to a new bank account for a steel supplier they had worked with for six years. The payment instructions came in an email that had the vendor's logo, the vendor's name, and a reference to a real outstanding purchase order. Three weeks later, the actual vendor called asking about the overdue invoice. The Hialeah shop had paid a criminal who had been watching that vendor's email for weeks.

That is how business email compromise works on a manufacturer. The attacker does not need to break into your network. They need to know who your vendors are, when invoices are due, and how your AP team processes payment changes. That information is often in a compromised vendor email account, a LinkedIn search, or a county business database.

The FBI's Internet Crime Complaint Center reported $2.9 billion in verified BEC losses for 2023. Manufacturing companies are among the hardest hit because the invoices are large, the payment windows are short, and production schedules create pressure to approve changes quickly so parts keep arriving.

Key Takeaways

• BEC attacks on manufacturers impersonate known vendors and request a payment detail change just before a large invoice is due.
• The FBI IC3 recorded $2.9 billion in BEC losses in 2023, with manufacturing consistently in the top five targeted industries.
• Manufacturers are high-value targets because they process large wire transfers for raw materials, tooling, and parts on tight production schedules.
• A callback verification policy, calling the vendor on a number from your own records rather than one in the email, stops most of these attacks before money moves.
• Cyber insurance routinely disputes BEC claims as "social engineering," so prevention is the only reliable protection.

How the Attack Gets Set Up Before You See the Email

The reconnaissance phase

BEC is not spam. A well-executed attack on a manufacturer takes weeks of preparation. The attacker needs to understand your vendor relationships before they act.

They start by compromising either your email or your vendor's. A phishing email to an AP clerk or an account manager at the steel supplier is the most common entry point. Once they have access to one inbox, they read months of correspondence to understand the relationship: which purchase orders are open, when payment is typically due, who at your company approves wire transfers, and what the vendor's standard billing email looks like.

With that baseline, the attacker creates a lookalike domain (something like "steelsupplier-llc.com" instead of "steelsupplier.com") or uses the compromised email account directly. Then they wait for a large invoice cycle.

The timing is not random

Most manufacturing BEC attacks land the week before a large invoice is due. The attacker knows the amount, they know the production deadline, and they know your AP team is under pressure to pay on time so parts keep arriving. The email says the supplier switched banks. It asks you to update your records. It says the change is effective immediately.

The reference to the real PO number, the correct invoice amount, and the vendor's authentic formatting make it look right. AP processes hundreds of documents a week. The approval goes through.

According to the FBI, the average BEC loss per incident across all industries is now over $137,000. In manufacturing, where individual vendor invoices regularly run into six figures, the number skews higher.

Actionable tip: Add one line to your AP policy today: any request to change a vendor's payment details requires a callback to a phone number from your own vendor records, not a number provided in the change request email.

What Makes Manufacturers a Preferred Target

Wire transfer volume and schedule pressure

Manufacturers make large, predictable payments on tight schedules. Steel, aluminum, electronic components, tooling: these suppliers send invoices in the tens or hundreds of thousands of dollars. Payment terms are short because your supplier has their own cash flow needs, and if you miss payment, your production line may stop.

That combination, large amounts and short windows with production pressure, is exactly what an attacker looks for. There is no equivalent setup in a professional services firm. A CPA firm paying a software vendor $12,000 can afford to call and verify. A plant manager waiting on $140,000 in raw aluminum scheduled for delivery Friday may not want to delay the payment when the email looks completely normal.

Vendor relationships that go back years

Long-standing vendor relationships create a false sense of security. When a vendor you have paid without incident for eight years says they switched banks, the instinct is to update the record and move on. Attackers specifically target these old relationships because the trust is already built in.

I sat with a plant operations manager in Doral last year who told me his company had paid the same steel supplier monthly for eleven years. When the fraud email came in referencing that relationship, nobody questioned it. The language matched. The numbers matched. The history matched. The only thing that had changed was the account number, and that is the one detail AP did not think to verify independently.

Actionable tip: For any vendor you pay more than $25,000 per transaction, keep a verified phone number on file, one you called when you first set up the relationship. Use that number for payment change verification, never a number from the email.

How Cyber Insurance Handles BEC Claims

The social engineering exclusion problem

Many manufacturers assume their cyber insurance policy covers BEC losses. Most of the time, it does not, or not fully.

Insurance carriers classify BEC as "social engineering fraud" rather than a computer crime. Depending on how your policy is written, the social engineering sublimit may be $100,000 on a policy that covers $1 million in breach costs. Some policies exclude it entirely unless you purchased a specific social engineering rider.

A manufacturer in Medley lost $230,000 to a BEC attack in 2024 and filed a claim expecting full coverage. The carrier paid $50,000 under the social engineering sublimit and denied the rest. The policy used the phrase "social engineering" in a way that was clear to an insurance attorney but not to the plant manager who had signed it two years earlier.

What to ask your broker before renewal

When your cyber policy comes up for renewal, ask your broker three specific questions. First: does my policy cover funds transfer fraud, and what is the sublimit? Second: does coverage require specific controls in place, and what are they? Third: would a written callback verification policy satisfy any of those control requirements?

The answer to the third question often leads to a coverage improvement. Carriers want documented processes for verifying payment changes. Having one in writing may not only cut your risk, it may also affect your premium tier.

Actionable tip: Pull your current cyber insurance declarations page and find the line item for "social engineering" or "funds transfer fraud." Note the sublimit. If it is below your average single vendor payment, bring that gap to your broker at renewal.

Gradient Data Solutions works with South Florida manufacturers to implement the technical controls that support vendor payment verification and email security. If you want to know how your current setup compares, request a free assessment and we will walk through your AP exposure with you.

The Technical Controls That Make BEC Harder to Execute

Email authentication is the starting point

Most manufacturing companies run Microsoft 365 for email. That is a workable foundation, but the default settings do not fully protect against domain spoofing.

Three email authentication standards work together to stop lookalike domain attacks: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance). SPF tells receiving mail servers which IP addresses can send email on your domain's behalf. DKIM adds a cryptographic signature to outgoing emails so the recipient's server can verify they came from you. DMARC ties these two together and tells servers what to do when they fail, typically "quarantine" or "reject."

Publishing a DMARC record with a "reject" policy tells every mail server on the internet not to deliver email that claims to be from your domain but fails those checks. This stops an attacker from spoofing "[email protected]" to your own AP team.

For manufacturers in the DoD supply chain, DMARC, SPF, and MFA are all assessed in CMMC Level 2 under Identification and Authentication and Configuration Management. Getting these controls right for BEC protection and CMMC is the same work. A prior post on CMMC Level 2 for manufacturers covers the broader audit timeline if you are working toward certification.

Multi-factor authentication for your AP team

Email spoofing is one attack path. Account takeover is the other. If an attacker logs in to your AP manager's email account, they do not need to spoof anything. They send the fraudulent payment change from the real account.

Microsoft 365 supports multi-factor authentication for every user, including your AP team. Enabling MFA does not require new hardware. It runs through Microsoft Authenticator on a phone the user already has. The setup takes 10 minutes. An attacker who has stolen your AP manager's password cannot log in without the second factor.

Conditional access policies in Entra ID let you enforce MFA specifically for users who have access to financial systems or share payment information by email, without requiring it for every employee on day one.

Actionable tip: Run a DMARC check on your domain today using a free tool like MXToolbox. If your DMARC record is missing or set to "p=none," your domain can be spoofed without any warning reaching your recipients.

The AP Process Controls That Prevent Fraudulent Payments

The verification callback is the most important control

Technical controls reduce the volume of fraudulent emails reaching your AP team. They do not stop a compromised vendor account sending a legitimate-looking email from the vendor's real domain. For that, you need a documented process.

The most effective process is a mandatory callback for any payment change, without exception. The call goes to a phone number your company has on file from when you first established the vendor relationship, not a number in the email, not a number in the email signature. Your own records.

This single policy blocks the majority of BEC attacks. It costs nothing to implement, it does not require software, and it gives your AP team a clear procedure that removes the pressure of making a judgment call on a suspicious email.

You can read more about how vendor access controls apply to the broader manufacturing security picture, including the technical side of what vendors can reach inside your environment.

Dollar thresholds and dual authorization

For payments above a set threshold, add a second approver. Many manufacturers already have dual authorization for check signing. The same logic applies to wire transfers.

Set the threshold based on your actual AP data. If your average vendor payment is $40,000 and your largest routine payment is $200,000, a $50,000 dual-authorization threshold covers most of your exposure without adding friction to small invoices.

Document both policies in writing and train your AP team on them once a year. A policy that nobody has read does not stop payments.

Frequently Asked Questions

Can BEC attacks be stopped by spam filters alone?

No. Spam filters catch mass-volume phishing, not targeted attacks. A well-crafted BEC email often comes from a real vendor account that was compromised, which means it passes spam filter checks. The email is not malicious by the criteria filters use. The process control, calling to verify payment changes, is what stops it.

Does CMMC require manufacturers to address BEC specifically?

Not by name, but several CMMC Level 2 practices address the controls that prevent BEC. Email authentication falls under Configuration Management. Multi-factor authentication is required under AC.2.007 and IA.3.083. If you are pursuing CMMC certification, implementing these controls for BEC protection and CMMC compliance is the same work, not two separate projects.

How quickly do most manufacturers discover the fraud?

The FBI reports that most BEC victims do not discover the fraud for 30 to 90 days, typically when the real vendor calls asking about an overdue invoice. By that point, the funds have moved through multiple accounts and recovery is unlikely. The FBI recovered less than 15 percent of reported BEC losses in 2023.

Should we verify payment changes even for vendors we have used for years?

Yes, and especially for those vendors. Attackers research long-standing vendor relationships specifically because the trust reduces scrutiny. A policy that applies only to new vendors misses the most common attack scenario.

What if a vendor objects to our verification process?

A vendor who resists your request to call and confirm their bank details before wiring a large sum is a vendor worth looking at more carefully. In practice, legitimate vendors understand payment verification. If a supplier pushes back, ask them to mail a letter on company letterhead with the new banking details and a contact name. That is a reasonable alternative, and any legitimate vendor will do it.

Ready to Review Your AP Security Controls?

BEC attacks on manufacturers are not random. They target companies with specific vendor relationships, large wire transfers, and no callback verification policy. Getting the technical controls and the AP process right is not a large project. It starts with a DMARC record, MFA for your AP team, and one sentence added to your payment policy.

If you want to know how your current setup compares to what attackers look for, request a free assessment from Gradient Data Solutions. We work with South Florida manufacturers on these controls and can give you a specific read on your exposure in one session.