Blog · Manufacturing
Phishing aimed at manufacturers: fake POs, vendor bank changes and QR codes
“We're a machine shop, not a bank. Who'd bother phishing us?” Plenty of people, because manufacturers move a lot of money to a lot of vendors, and the email that kicks it off usually lands in a busy, shared inbox.
The old advice was to watch for bad spelling and strange links. AI has fixed the spelling. Today's phishing emails read like they came from your steel supplier, your biggest customer or your own owner.
How phishing reaches a shop
- Fake RFQs and purchase orders. A “new customer” sends a drawing package or PO as a zip file or link. Opening it installs malware or asks for a Microsoft 365 sign-in.
- Vendor bank changes. An email that looks like it's from a real supplier says their bank details have changed. The next payment for a load of material goes to a criminal's account. This is business email compromise, and it cost US businesses about $3 billion in 2025, according to the FBI.
- Freight and delivery notices. Texts and emails about a held shipment or a customs fee, aimed at receiving, shipping and drivers, often on their phones.
- QR codes. A QR code on an invoice, a package label or a flyer in the break room leads to a fake sign-in page. Email filters struggle to read them, and phones make them easy to scan.
- A familiar voice. AI can clone a voice from a short clip. The “owner” calls the office manager from the road and needs a payment sent before the end of the day.
- Shared mailboxes. Addresses like quotes@, sales@ and ap@ get the most outside email, and they're often the least protected.
Why shops are exposed
Most manufacturers have the same pattern: a few office staff handling a high volume of vendor and customer email, shared PCs on the floor that are logged in all day, and email on personal phones. Production pressure means requests get handled fast. That's exactly what attackers count on.
How to shut it down
- Verify every bank change by phone, at a number from your vendor file, never one in the email. Add a waiting period before the first payment to new details.
- Multi-factor sign-in for everyone, and block direct sign-in to shared mailboxes so they can only be reached through a protected user account.
- Inspect attachments and links before they arrive. Email security that opens files in a sandbox catches most malicious RFQs and drawing packages.
- Keep the shop floor off email. Machine-attached PCs and kiosks shouldn't browse the web or read mail.
- Train the people who get targeted: purchasing, accounts payable, receiving and whoever answers quotes@. Use real examples from your industry, not generic slides.
- Make reporting one click. A “Report phishing” button and a thank-you every time someone uses it. The earlier you hear about a fake, the fewer people click it.
- Keep everything patched, including the browser and PDF reader on the office PCs that handle outside files.
The goal isn't a team that never gets fooled. It's a process where getting fooled once doesn't send a truckload of money somewhere it can't come back from.