Email security for manufacturers: the risks and the controls that work

Manufacturers run on purchase orders, supplier invoices, shipping notices and freight bookings, and most of them arrive by email. Criminals have learned to steal the goods as well as the money: they order product on credit with no plan to pay, or hijack the shipment on its way out. Ransomware adds the risk of a stopped production line. This guide covers the email threats specific to manufacturing, using FBI and CISA material, and the controls that address each one.

Why are manufacturers targeted by email?

Manufacturers are targeted because they move high-value goods and payments on email instructions, across long supplier and customer chains, and because production downtime is costly. A plant may deal with hundreds of suppliers, distributors, freight brokers and carriers. Every one of those relationships can be impersonated.

The FBI's Internet Crime Complaint Center (IC3) data shows the risk (IC3 2025 report):

• The ten ransomware variants most reported to IC3 in 2025 "most impacted" three critical infrastructure sectors: Critical Manufacturing, Healthcare and Public Health, and Government Facilities.
• IC3 received more than 1,400 ransomware complaints from organizations outside the critical sectors. Non-critical manufacturing, such as furniture and building materials, made up 5% of them.
• Across all industries, IC3 recorded 24,768 business email compromise (BEC) complaints with $3,046,598,558 in reported losses. BEC is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money or goods.

What email scams target manufacturers?

Manufacturers see general phishing plus schemes built around orders, credit and shipping.

Fake purchase orders on credit

The FBI warns that criminals spoof the email domains of real US companies, using the names of current or former employees, to place bulk orders. They apply for Net-30 and Net-60 credit terms with "fake credit references and fraudulent W-9 forms," which lets them order more without paying upfront. Targeted goods include construction materials, agricultural supplies, computer hardware and solar energy products (IC3 PSA I-032423-PSA).

Food and ingredient makers have been hit hard. A joint FBI, FDA and USDA advisory describes a food distributor that received an email "from" a multinational snack company requesting two truckloads of powdered milk. The sender used the real CFO's name but a domain with one extra letter. The distributor had to pay its own supplier more than $160,000 for that shipment (advisory AA22-340A). The advisory also notes that criminals file falsified credit applications using a real company's details, so the credit check comes back clean.

Here's an example of the kind of request to verify before you ship:

Example: "Please find attached PO #44817 for 2 full truckloads, delivery to our new distribution site. We'd like to set up Net-30 terms. Credit application and W-9 attached. Kindly confirm ship date."

Freight and cargo theft

In April 2026 the FBI warned of a surge in "cyber-enabled strategic cargo theft" (IC3 PSA I-043026-PSA). Attackers spoof brokers' emails with links to a "carrier broker agreement" or a complaint to "review", which install remote management software. Then they pose as the compromised carrier, accept real loads and reroute them. The FBI says they also change the carrier's contact details with the Federal Motor Carrier Safety Administration, so a carrier may not realize it's compromised until brokers ask about missing loads. The FBI cites estimated cargo theft losses in the US and Canada of nearly $725 million in 2025, a 60% increase on 2024.

Its warning signs that apply to a manufacturer's shipping desk include:

• emails that spoof real company domains using free email providers
• requests to download documents from shortened or spoofed links
• emails about "negative service reviews" with links to resolve them
• new or unauthorized mailbox rules, such as forwarding to outside addresses

How do you verify orders and payment changes?

Verify every new customer, every credit request and every bank detail change through a channel the requester didn't give you. The FBI's advice is to call "a business's main phone line to confirm the identity and employment status of the email originator, rather than calling numbers provided via email" (IC3 PSA I-032423-PSA). A working procedure:

1. Look up the customer yourself. Find its main number on its website or through an association or business directory, as the FBI, FDA and USDA advisory recommends.
2. Call and confirm that the buyer works there and placed this order.
3. Compare the domain letter by letter. Look for extra letters, swapped characters such as "1" for "l", added words like "-usa" or "group", and different endings.
4. Check the delivery address belongs to the customer, especially for a "new site" or a third-party warehouse.
5. Hold a second load until the first is paid when a new account orders large volumes on credit.
6. Never change supplier bank details on an email alone. Call on a number you already hold, and require a second approver. Our vendor invoice fraud guide covers this procedure in detail.
7. Verify freight pickups through a second method before releasing a load, and keep records of drivers, trucks and carrier numbers, as the FBI suggests.

Search the web regularly for your own company name too. The advisory notes that fake domains such as abccompany.biz can be used to impersonate a real company, including yours. See lookalike domain phishing.

How does email lead to ransomware on the plant floor?

Email usually provides the first foothold, not the encryption itself. CISA and its partners describe phishing as the way attackers gain "initial access", either by stealing credentials or by getting a user to run malware (CISA phishing guidance). From an office PC, attackers move toward the systems that matter most.

The IC3 report's ransomware recommendations include network segmentation "to prevent the spread of ransomware", MFA for all services where possible, particularly webmail, VPNs and accounts that access critical systems, and off-site or offline backups that are encrypted and immutable. For a manufacturer, that means:

• Keep office email and browsing off machines that run production equipment.
• Separate production networks from the office network, so a phished laptop can't reach them directly.
• Block risky attachment types and Office macros from outside senders. See Office macros blocked from the internet.
• Give plant staff a fast way to report a suspicious email, and a plan to isolate a device that ran something unexpected. Our ransomware by email guide covers the full sequence.

Do defense suppliers have extra email requirements?

They can, if you hold Department of Defense contracts that include CMMC requirements. The CMMC (Cybersecurity Maturity Model Certification) program verifies that contractors have implemented the security measures needed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program rule, 32 CFR Part 170, took effect on December 16, 2024 (Federal Register). The DFARS rule that puts CMMC requirements into contracts took effect on November 10, 2025 (Federal Register).

Drawings, specifications and contract details often travel by email. If FCI or CUI passes through your mailboxes, our reading is that your email platform and the services that handle that mail are likely part of what you must protect. How your environment is scoped depends on your contracts and setup. Confirm it with your assessor or adviser before you choose or change email services; this guide isn't legal or compliance advice.

Manufacturing email security checklist

1. Require MFA on every mailbox, starting with sales, credit, accounts payable, shipping and admins.
2. Write down your verification procedure for new customers, credit requests, bank changes and freight pickups.
3. Publish SPF, DKIM and DMARC, and move DMARC to p=reject so mail faking your exact domain is refused. See DMARC from none to reject.
4. Filter inbound mail for phishing, spoofing and malware, and block risky attachment types.
5. Check mailboxes for unexpected forwarding rules. See malicious inbox rules.
6. Segment production networks from office IT, and keep offline backups.
7. Brief sales, credit and shipping teams on fake purchase orders and freight scams.
8. If you're a defense supplier, map where FCI and CUI travel by email before your CMMC assessment.

Next steps

• Check your domain's SPF, DKIM and DMARC with the free Email Health Check.
• Search for lookalikes of your company domain and your largest customers' domains.
• Share the verification procedure above with sales, credit, AP and shipping this month.
• For wider basics, see the small business email security checklist. iBlockSpam's per-domain pricing covers every mailbox on a domain, including plant and shift accounts; that means mailbox count, not unlimited volume (100,000 inbound messages per domain per month are included).

More threat guides are in our phishing and threats topic.