longtime supplier emails your accounts payable desk. The message is routine: updated remittance information and a new bank account. Please apply it to the next payment. The letterhead is right. The signature block matches. The email address is the one your team has used for years. So, your team updates the vendor file and pays the next invoice. A few weeks later, the real supplier calls to ask where its money is.

That money is almost certainly gone, and the scenario above illustrates one of the most common and expensive crimes affecting business-to-business companies today. It doesn’t require a hacker breaking through a firewall. It requires nothing more than a convincing email and a payment process with a weak spot. Distributors and fabricators in the performance plastics industry are particularly vulnerable, and many don’t realize how exposed a single routine payment can leave them.

The FBI tracks these crimes through its Internet Crime Complaint Center, known as IC3. In its 2024 Internet Crime Report, the FBI tallied a record $16.6 billion in reported losses, a 33% jump over 2023.

One of the costliest categories wasn’t ransomware or a dramatic system breach. It was business email compromise (BEC), a form of fraud that tricks an organization into sending money to a criminal. BEC was the second-costliest category of internet crime reported to the FBI in 2024, accounting for roughly $2.77 billion in losses that year and nearly $8.5 billion from 2022 through 2024.

And those are only the cases that were reported. According to the Association for Financial Professionals’ 2025 Payments Fraud and Control Survey, 63% of organizations experienced business email compromise in 2024. This isn’t a rare event that happens to other companies. It’s a persistent threat to businesses that routinely exchange invoices, purchase orders and payment instructions by email.

Criminals follow money that moves on a predictable schedule, and few businesses move money as steadily as a plastics distributor, fabricator or manufacturer. Every week brings purchase orders to material suppliers, payments to freight carriers and invoices going out to customers. High transaction volume means a fraudulent request can blend in with legitimate ones. A finance team processing dozens of supplier payments is accustomed to keeping things moving, and that momentum is exactly what the fraud exploits.

The industry also runs on relationships and email. Quotes, order confirmations and remittance updates travel by email all day long, often between people who have never met in person and who trust the familiar rhythm of the correspondence. A fabrication shop juggling rush orders and a customer waiting on a shipment may not think twice about a banking information change from a vendor it has paid a hundred times. Criminals understand that pressure, and they time their requests to take advantage of it.

Most of these attacks follow a pattern. First comes reconnaissance. A criminal gains access to an email account, sometimes a vendor’s rather than yours, by stealing a password through a phishing message or another method. Once inside, the criminal may read messages quietly for days or weeks, learning who pays whom, what invoices look like and how requests are phrased. They’re studying your business, in your own words.

Then comes the impersonation. The criminal sends a message that looks like it belongs in an existing email thread, often from a look-alike address that differs by a single character or from the genuine compromised account itself. The request is almost always the same: Payment information has changed; please update the account on file. Sometimes the message adds urgency, perhaps a note that the change needs to be completed before the next payment run so a shipment isn’t delayed.

Finally comes the transfer. The payment lands in an account the criminal controls and may be moved out within hours, sometimes across borders or into cryptocurrency, before anyone notices. By the time the real vendor follows up about a missing payment, recovering the funds may be extremely difficult.

The crime is quiet, it’s fast and it can go undetected until the legitimate supplier asks why an invoice hasn’t been paid.

The encouraging part is that many of these attacks can be prevented, and the defenses cost little beyond discipline. A handful of habits, applied consistently, can significantly reduce the risk.

Verify every banking change independently. This is the single most important control. Any request to add or change payment details should be confirmed by a phone call to a number you already have on file, never a number or link supplied in the request itself. A quick call to a known contact can stop a fraudulent payment before it happens. Make it a nonnegotiable step, not a courtesy.

Build a formal change process. Decide in advance who is allowed to alter vendor banking information and require a second person to approve it. When changing a payment account takes two people and an independent verification step, a single deceived employee can no longer redirect a payment without additional review.

Require multifactor authentication on email. Because these attacks often begin with a stolen password, protecting the inbox is essential. Multifactor authentication adds another layer of security, making it more difficult for criminals to access an account using stolen credentials. While it doesn’t eliminate every risk, it’s one of the most effective safeguards available.

Train the team to slow down. Urgency is one of the fraudster’s favorite tools. Staff who manage payments should feel empowered to pause when they receive an unexpected change request, no matter how routine it seems or how much pressure accompanies it. Short, practical reminders throughout the year can reinforce good habits and help employees recognize suspicious requests before they act.

Watch the address, not just the name. Look-alike email domains are easy to miss when an inbox shows only a display name. Encourage staff to expand the full email address on any payment-related message and treat an unfamiliar reply-to address as a reason to verify by phone. Remember that even a legitimate email address can be compromised, so checking the address should never replace independent verification of banking changes.

When prevention fails: The first hours matter
Even disciplined companies get caught occasionally, and speed is everything once a fraudulent payment goes out. The FBI maintains a recovery process that can sometimes freeze funds before they disappear, but it works best when victims act quickly.

If a wire transfer goes to the wrong account, contact your bank immediately and ask it to attempt a recall. Then report the incident to the FBI’s Internet Crime Complaint Center at www.ic3.gov.

According to the FBI’s 2024 Internet Crime Report, its Recovery Asset Team reported a 66% success rate in Financial Fraud Kill Chain actions, freezing approximately $561.6 million in fraudulent domestic and international transactions. That doesn’t mean every dollar was recovered, but it shows why acting quickly matters.

Knowing these steps before an incident, rather than scrambling to find them during one, can make the difference between recovering a payment and losing it entirely.

Strong internal controls are essential to preventing payment fraud, but even well-managed companies can experience a loss. Insurance provides an additional layer of protection, particularly when a fraudulent transaction results in significant financial exposure.

One common misconception among business owners is that their existing commercial insurance policies will cover losses associated with cybercrime. In reality, traditional general liability, commercial property and other standard business insurance policies often provide limited coverage for cyber-related incidents, if they provide coverage at all.

This distinction is particularly important for performance plastics distributors, fabricators and manufacturers. Companies that regularly transfer substantial payments to suppliers, manage customer financial information and rely on interconnected business systems face risks that traditional commercial insurance was not necessarily designed to address.

Dedicated cyber insurance can help fill some of these gaps.

Depending on the policy, cyber insurance may provide financial protection for certain cyber-related losses, including costs associated with data breaches, business interruption, system restoration and incident response. Some policies also offer coverage for fraudulent electronic payments.

However, business owners shouldn’t assume that purchasing cyber insurance automatically protects them against every form of payment fraud.

Insurers often distinguish between situations in which a criminal gains unauthorized access to a computer system and transfers funds directly and situations in which an employee is deceived into authorizing a payment.

The second scenario is commonly referred to as social engineering fraud.

Coverage for social engineering, computer fraud and funds transfer fraud may be addressed under different policy provisions or endorsements. In some cases, these coverages carry limits substantially lower than the overall cyber insurance policy limit. Certain losses may also be addressed through commercial crime insurance rather than a cyber policy.

For example, a company could carry $1 million in cyber insurance coverage but have a much lower limit for losses resulting from fraudulent payment instructions. If an employee unknowingly transfers $250,000 to a criminal’s account, the amount recoverable through insurance could be significantly less than the company’s actual loss.

Coverage may also depend on whether the company followed established payment verification procedures before authorizing the transfer.

For these reasons, business owners and financial executives should work with an insurance professional who understands cyber risks and can evaluate how their existing policies respond to the exposures their businesses face.

That review should address not only whether the company has cyber insurance, but whether it has appropriate coverage for social engineering, fraudulent funds transfers, business interruption and other potential losses.

Cyber insurance should be viewed as an important component of a company’s overall risk management strategy, not simply an optional addition to its existing commercial insurance program.

The combination of strong internal controls, employee awareness and appropriately structured insurance coverage provides a more comprehensive approach to protecting a company’s financial resources.

Payment fraud thrives on routine and trust, the two things a busy distribution business relies on every day. It doesn’t announce itself, and it doesn’t necessarily require sophisticated technology to succeed.

Sometimes all it takes is one unverified change to a vendor’s banking information.

The good news is that the same routines that create the exposure can become part of the defense. Verify changes by phone. Require a second set of eyes. Secure your email accounts. Give your team permission to slow down when something doesn’t seem right.

Just as important, understand where your traditional commercial insurance coverage ends and whether dedicated cyber insurance provides the financial protection your business needs.

For performance plastics companies, payment fraud deserves the same attention as other significant operational and financial risks. Building verification procedures into everyday operations, supported by appropriately structured insurance coverage, can help prevent a routine transaction from becoming a costly financial loss.

Kody Houk is principal of PrimeRisk Insurance Solutions, a commercial insurance brokerage specializing in cyber and technology risk for companies across the performance plastics supply chain. For questions about the concepts covered in this article, contact him at kody@primeriskinsurance.com or 480-613-8387.