PDA Fraud and Bank-Detail Change Scams: How Port Suppliers Verify a Payment Request

PDA fraud and bank-detail change scams are attempts to divert a port disbursement account payment to a criminal's bank account, usually by email that impersonates the ship agent, owner or manager. The defence is a callback on a number you already hold, dual approval and a document check before any payment leaves your accounts.

For port suppliers, the risk sits in the busiest part of the workflow: the hours between a vessel's ETA and her sailing, when a ship agent is chasing a PDA, a chandler is issuing a final disbursement note and a bunker supplier is confirming a payment reference. That is exactly when a change-of-bank-details email reads as routine.

Why PDA fraud hits port suppliers hardest

A port disbursement account bundles agency fees, port dues, pilotage, towage, berth charges and supplier invoices into one settlement. The agent collects the funds and pays the suppliers, so the agent sits at the centre of a dense web of counterparties.

That makes the ship agent a high-value impersonation target. A criminal who can pass as the agent, or as the owner's accounts team, can redirect a PDA or a single supplier invoice with one well-timed email.

The threat is not theoretical. According to Splash247 (October 2026), a cyber extortion group called n0n claimed data from 38 shipping, port and logistics companies in a single batch on 12 October 2026. Hellenic Shipping News (October 2026) reported that the targets included ship managers and agents in 18 countries. Where stolen email and contact data circulate, convincing bank-detail change requests follow.

Fraud also arrives through procurement. Marine Insight (October 2026) reported five arrests in Norway over suspected fraud and bribery in contracts to supply NATO ships. The pattern is the same: a trusted supplier relationship used to move money to the wrong account.

The three scam shapes to recognise

• Bank-detail change request. An email that looks like it comes from the agent or owner, announcing new account details for future PDAs or outstanding invoices.
• Fake invoice or final note. A supplier invoice or disbursement note with altered bank details, sent close to a vessel's departure when staff are under time pressure.
• Executive impersonation. A message from a spoofed senior manager instructing accounts to pay urgently and not to call the agent because they are travelling.

Each depends on urgency and on the reader not checking through a second channel.

The verification checklist before you pay

Verify every payment request through a channel you already trust, not through the channel that delivered the request.

1. Call back on a known number. Use the number in your vendor master record or on the agent's own website, never the number in the email. Ask the agent's accounts contact to confirm the change verbally.
2. Apply dual approval. Require two people to sign off any new bank detail, any first payment to a new account and any PDA above an agreed threshold.
3. Check the documents. Compare the invoice against the fixture, the port call record and the vessel's IMO number. Look for mismatched company names, altered logos and a bank account in a different country from the supplier's registered address.
4. Inspect the email headers. Check the sender's actual domain, not the display name. A reply-to address that differs from the from address is a red flag.
5. Confirm through a second person at the counterparty. Ask a named operations contact, not the accounts address, to confirm the change.
6. Log and freeze. If anything fails, stop the payment, notify your bank and tell the agent by phone. Report the incident to your national cybercrime authority.

Build the controls into the port call, not after it

Research on maritime cyber risk shows that human factors, not just systems, drive outcomes. A 2021 study in IEEE Communications Standards Magazine argued there is a clear link between seafarer training and maritime safety, and called for standardised digital competencies. The same logic applies ashore: accounts staff and port agents need a rehearsed routine for bank-detail changes.

A 2021 systematic review in IEEE Access found that research on cyber risk perception in the maritime domain was still thin, with no studies relevant to its review found in the field. That gap is a reason to write your own procedure rather than wait for an industry standard.

Three controls do most of the work:

• Vendor master data locked. Only finance can change bank details, and only after a documented callback.
• Payment calendar tied to the port call. Know which PDAs and supplier invoices fall due around each vessel's arrival and departure, so nothing is paid in a rush.
• Named contacts per counterparty. Record the agent's accounts and operations contacts, and the owner's or manager's technical and purchasing superintendents, so a verification call reaches a real person.

Documented port supply chains already depend on traceability. A 2020 paper in the Nordic and Baltic Journal of Information and Communications Technologies described how distributed ledger features enrich trust through transparency and traceability in port transactions. Until such systems are common, a callback and a second signature are the practical equivalent.

What to do in the first hour of a suspected scam

1. Stop all payments to the account in question.
2. Call your bank's fraud line and request a recall if funds have left.
3. Phone the agent and the owner or manager on numbers you already hold.
4. Preserve the email, headers and any attachments for the police and your insurer.
5. Warn other suppliers in the port, because the same stolen contact list is often reused.

Speed matters more than perfection. A recall request in the first hours has a better chance than one filed after the vessel has sailed.

How VesselReach helps

VesselReach, built by CatalystIQ, keeps the counterparty detail you need for a verification call in one place, tied to the vessels and port calls that generate the payment.

• Decision-maker discovery finds operations, chartering, procurement and C-suite contacts by role, which means your team can reach a named person to confirm a bank-detail change instead of replying to the email that requested it.
• Vessel intelligence shows vessels near your ports and expected arrivals, which means PDAs and supplier invoices are anticipated around a real ETA rather than paid under last-minute pressure.
• AI enquiry handling with human handoff answers routine payment and document questions from approved information and escalates to your team when it cannot verify an answer, which means unusual payment requests reach a person.

Book a VesselReach demo to see how the workflow fits your port calls and your accounts controls.