Commodity trading has every ingredient fraudsters look for: large single payments, many counterparties across time zones, tight deadlines and a constant flow of invoices and documents by email. Payment-diversion fraud — often called business email compromise or invoice redirection — exploits all of them.
How the attack works
- Access or impersonation. The attacker either compromises a real mailbox (yours or your counterparty's) or registers a lookalike domain.
- Patience. In a compromised mailbox, they read ongoing threads and wait for an invoice to fall due.
- The switch. A message arrives — perfectly timed, often replying in the real thread — announcing new bank details "due to an audit" or "a change of bank".
- Pressure. The request comes with urgency: demurrage is running, the vessel is waiting, the shipment will be released elsewhere.
By the time anyone notices, the funds have usually moved on through several accounts.
Process controls that stop the loss
- Callback verification. Any change of bank details is confirmed by phone with a known contact, using a number from your own records or the original contract — never from the email requesting the change.
- Dual authorization. Payments above a threshold, and every change to beneficiary details, require two people.
- Change freeze. New bank details can't be used for a first payment until a cooling-off period has passed and the verification is documented.
- Bank details in the contract. Agree in the sale contract which accounts will be used and how changes must be notified.
- Small test payments for new beneficiaries, confirmed by the recipient through a separate channel.
Technical controls that reduce the risk
- Email authentication — publish SPF and DKIM and enforce DMARC so others can't easily spoof your domain.
- Lookalike-domain monitoring — watch for newly registered domains that imitate yours or your key counterparties'.
- Phishing-resistant MFA on email and banking, so a stolen password isn't enough.
- External-sender banners and alerts for messages that mention bank details or payment changes.
- Document integrity — share invoices through a portal or signed PDFs rather than editable attachments.
Training that actually works
Generic awareness slides don't change behavior. Short, role-specific drills do: walk the treasury and operations team through a realistic "change of bank details" scenario, and make the callback rule something everyone follows without exception — including senior management.
How Mirage IT helps
We run email-security reviews, implement DMARC and MFA, design payment-approval workflows and train finance and operations teams — drawing on how our own trading desk handles payments every day. To review your controls, talk to Mirage IT.
