The cyber attack that actually kills towing companies is an invoice

When towing operators imagine a cyber attack, they imagine the wheelhouse: someone seizing an engine, spoofing a chart, steering steel from a laptop. That scenario sells conference talks. It is not what the record shows happening to companies your size. The attack with the receipts — the one measured in billions of documented losses every year — arrives as an email about money. A fuel vendor's invoice with new bank details. A shipyard's payment reminder from an address one letter off. A wire instruction that looks exactly like the last forty because the attacker read the last forty before writing it.

The industry calls it business email compromise, or BEC. A better name for a towing company is what it actually is: invoice fraud with a mailbox behind it. No malware, no exploit, nothing technical to detect. The attacker takes over or convincingly imitates an email identity somewhere in your payment chain, waits for a real transaction, and redirects a legitimate payment to an account they control. The exploit is trust, plus the ordinary way barge freight settles — invoice, approval, ACH — run by one controller who has no reason to be suspicious on an ordinary Tuesday.

The numbers, which are not close

The FBI's Internet Crime Complaint Center puts reported BEC losses for 2024 alone at $2.77 billion across 21,442 complaints — the second-costliest category of internet crime in a year whose reported losses totaled $16.6 billion. Across 2022 through 2024, reported BEC losses approach $8.5 billion. Those are reported figures; actual losses run higher, because companies eat losses they never report.

The insurance data says the same thing from the other side: in one major cyber insurer's 2026 claims report, email compromise and funds-transfer fraud together made up 58 percent of all cyber claims, with the average funds-transfer loss around $141,000. For a family towing company, $141,000 is not an IT problem. It is a boat payment.

And the maritime record is not silent. The Coast Guard's own cyber assessors report that phishing accounted for a quarter of reported incidents in the marine transportation system in 2024, many involving compromised business email — hijacked legitimate accounts sending fraud onward, which defeats the check-the-sender habit entirely. The documented towage case is Svitzer Australia, 2018: auto-forwarding rules quietly planted on three employee mailboxes — finance, payroll and operations — exported some 50,000 to 60,000 emails over roughly eleven months before anyone noticed. A tug operator, a finance mailbox, and nobody watching the mailbox rules.

Why your office fits the profile

Attackers do not read applicability tables; they read victim profiles, and a towing company matches the BEC profile line by line. Payments settle by emailed invoice and electronic transfer. Approval concentrates in one controller or office manager. The vendor master file — who you pay, and where — is a spreadsheet nobody formally owns. Payment details get confirmed over the same email channel an attacker already controls, and sometimes in dispatch text threads. There is no second person whose job is to be suspicious.

Notice what is missing from that list: anything marine. This is why the "we're just a small towing outfit, nobody would target us" instinct fails. BEC is not targeted the way owners imagine; it is farmed. Your company does not need to be interesting. It needs to pay invoices, and it does.

What the rule has to do with a con

Here is the connection that surprises people: the Coast Guard's cyber rule, read against this threat, is unusually practical. Three of its measures land directly on the fake invoice.

Training that reaches the person who pays (§101.650(d)). The rule requires annual cybersecurity training for everyone with access to your IT systems — and that obligation has been in force since Jan 12, 2026, with inspectors already verifying records. The scenario that belongs at the center of that training for a towing company is not a hacker in a hoodie; it is a vendor emailing new bank details. The single cheapest control against BEC is a person who pauses — and a written habit behind the pause: bank-detail changes get verified by a phone call to a number you already had, never to one in the email.

Separate credentials and MFA (§101.650(a)). The rule requires multifactor authentication on password-protected IT and separate credentials for critical systems versus business email. Both attack the mechanics of mailbox takeover: MFA makes the initial account compromise harder, and separation means the email password is not also the banking password. The Svitzer pattern — a quiet forwarding rule running for months — is exactly what these account measures exist to prevent and what reviewed logs exist to catch (§101.650(c)).

Reporting without delay (§101.650(g)(1)). A compromised company mailbox, or a fraudulent transfer touching your covered systems, belongs on the call to the National Response Center — a duty in force since Jul 16, 2025. And the minutes matter beyond compliance: a wire reported fast is sometimes recoverable; one reported Monday is gone.

The reframe, stated once

We use a line on calls, and it belongs here: nobody is going to steer your towboat from a laptop — they are going to steal from your office. The point is not to dismiss the wheelhouse; navigation systems and engine telematics are in your assessment for good reason, and we have written about them at /the-rule/technical-measures. The point is proportion. When the rule asks you to train every hand, secure every account and write down who calls whom, it is not preparing you for a movie plot. It is preparing your office for the fraud that is already, verifiably, the most expensive thing happening to companies like yours.

That is also the honest answer to the operator who sees the rule as Washington paperwork. The paperwork obligations are real, and we will not pretend otherwise. But the substance — a trained controller, a hard account, a phone number on the wall (§101.640 keeps the record of the training and the incident both) — is the substance a good insurance broker or a burned competitor would tell you to build anyway. The rule just put a deadline on it.

Train the person who pays the invoices first; the rest of the program is explained at /the-rule/training, and the printable documents that support it are in the downloads.

If you want the fraud scenario walked through against your own payment chain, book a readiness call at /book.