Maritime Cybersecurity: How to Spot Fake Agents and Fake Support Calls
The email lands late on a Friday afternoon, with the ship due alongside on Monday. The port agent, or someone who looks exactly like them, explains that their bank account is temporarily frozen for the annual audit and supplies new details for the port disbursement account. The sender's address differs from the real one by a single letter. The payment goes out, and it is only days later, when the genuine agent chases an unpaid proforma, that the company realises what has happened.
None of this is invented. It is, almost word for word, the funds-diversion fraud that the insurer ITIC has warned its members about. It also points to something mid-sized operators routinely underestimate. Maritime cybersecurity is decided less on the bridge systems than in everyday actions: a bank transfer, a password, a Wi-Fi connection in port. This article walks through the most common frauds in shipping and yachting, then the basic cyber hygiene that defeats most of them.
What maritime cybersecurity actually covers
Maritime cybersecurity is the set of measures that protect ships, shipping companies and port facilities against malicious acts targeting their IT systems and data. It spans two worlds that increasingly overlap: business IT, meaning email, accounting, documents and fleet software, and the operational technology on board, from ECDIS to engine-room automation and satellite communications.
It is no longer optional. Under Resolution MSC.428(98), the International Maritime Organization expects cyber risks to be addressed in the safety management system required by the ISM Code, no later than the first annual verification of the company's Document of Compliance after 1 January 2021. The MSC-FAL.1/Circ.3/Rev.2 guidelines set out the method: identify, protect, detect, respond, recover. An operator that cannot show how it handles the risk should expect an observation at its next ISM audit.
A threat that is mostly criminal, and growing
According to the first maritime cyber threat report published in May 2023 by France Cyber Maritime, its M-CERT alert centre and the firm OWN, close to 90 notable public incidents hit the global maritime and port sector in 2022, up 21% on the previous year and 235% on 2020. Europe was the most affected continent.
The same report finds that cybercrime remains dominant, ahead of espionage and hacktivism. Most attackers, in other words, are not trying to take control of a ship. They want money, and the shortest route runs through the inbox. These figures also count only incidents that became public; attempts that were stopped or quietly absorbed, common in smaller companies, do not appear.
Fake agents, fake suppliers, fake support: three scenarios to recognise
Frauds aimed at shipping rarely involve technical brilliance. They exploit the time pressure of a port call, the number of parties involved and the trust people place in a familiar voice or logo.
The fake agent or supplier. A message announces new bank details for a port disbursement, a bunker delivery or a shipyard invoice. This is the maritime version of what specialists call Business Email Compromise, or BEC.
The fake support call. A phone call, text or WhatsApp message claims to come from a software vendor, a bank or a flag administration, and asks for a password or a one-time code "to secure the account". Some fraudsters even have victims key their credentials into the phone keypad in front of a fake automated line.
The fake document. An attachment presented as a certificate, a crew list or a repair order actually leads to a spoofed login page that captures email credentials, opening the door to the first two scenarios.
What the three have in common is that they bypass technical defences by going straight to a person, often in a hurry, sometimes at sea on a patchy connection that makes any check difficult.
No legitimate counterparty, whether an agent, a bank, a flag state or a software vendor, will ever ask for your password or a verification code by phone, text or WhatsApp.
At BoatOn the rule has no exceptions: our team will never ask for your BoatOn Book credentials, verbally or in writing. If anyone does so in our name, hang up and contact us through your usual channel.
The cyber hygiene habits that make the difference
Cyber hygiene is the set of everyday habits that reduce an organisation's exposure to attack. It does not replace a formal security policy, but it is the first line of defence, and it costs next to nothing.
Ashore, in operations and accounts
Call-back verification. Any change of bank details is confirmed by calling the supplier on a number you already hold, never the one in the message. This is ITIC's core recommendation.
Dual payment approval. Above a set threshold, a transfer needs two signatories. It sounds heavy, yet it is the only control that holds when a fraudster already controls a mailbox.
Multi-factor authentication. Turn it on for email, banking and fleet software wherever it is offered. A stolen password is then no longer enough to open the account.
On board and in port
Unique passwords. One password per service, kept in a password manager, rather than a ship-wide code on a sticky note by the console.
Named accounts. Each officer logs in with their own account, so access can be removed at crew change without resetting codes for everyone.
Segregated networks. Crew and guest Wi-Fi never share the network that serves shipboard systems. Public networks in marinas and terminals are treated as untrusted.
Controlled removable media. A USB stick brought aboard by a contractor is scanned before it goes anywhere near a bridge or engine-room workstation.
Tracked updates. Workstation and software updates are applied as soon as operations allow, and logged like any other job.
Building cyber risk into day-to-day operations
These habits only count if they last, and that is exactly where small fleets slip. Passwords get emailed at crew change, certificates travel as attachments from one inbox to the next, shared accounts outlive the people who used them. Every document sent by email is one more chance for a fraudster to slip a fake into the flow.
Centralising information shrinks that attack surface. In BoatOn Book, the vessel's certificates and documents sit in the Documents module instead of being passed around by email, maintenance and crew are tracked in the same marine CMMS, and every user signs in with their own account. The electronic logbook follows the same logic: a single, time-stamped record that depends on no attachment. The stakes rise with fleet size, as we showed when looking at running a fleet of ten ships.
For operators that still need to bring cyber risk into their safety management system, the ISM Checker gives a quick first assessment, and BoatOn Consulting supports ISM and ISPS work. Physical security duties, including access control and records, are covered in our piece on the ISPS Code.
Vigilance comes down to a few habits
Most frauds that hit shipping require no technical skill at all; they exploit a moment of inattention. Three habits defeat most of them: verify any change of bank details through a second channel, switch on multi-factor authentication, and never share a password or code, whoever is asking. The rest is operational discipline, just like planned maintenance or hours-of-rest records. It is not the procedure that protects a shipping company, but applying it, day after day.
Illustration photos: Sergii and Tom Fisk on Pexels, free licence. They do not show any particular vessel or port call.