The foreign-trade team of a steel producer received a routine email from an international trader they'd been sourcing scrap from for months: the proforma for the new lot was ready; loading port and tonnage matched previous orders. The only difference was the bank details at the bottom of the invoice — pointing to an account in a different country, justified as an "intra-group account restructuring." The spot price was favorable that day, the loading window was closing; the payment went out the same day. When the real trader wrote two days later — "we're still waiting for the proforma" — a six-figure EUR amount had evaporated.
Iron and steel sits at a special intersection for email attackers: a market where commodity prices move by the hour, very high-value and mostly foreign-currency transfers, an international trader/scrap supply network, and a "lock the price before it runs" speed culture. In this article we cover the sector's attack surface, four threat vectors, and the path to defense.
1. Why Does the Iron & Steel Workflow Favor the Attacker?
Three structural features of the sector weaken classic confirmation mechanisms:
- Spot-market speed: Scrap, ore, billet, and hot-rolled prices change within the day. The "this price is valid today" pressure makes second-channel verification before payment feel like a luxury — the attacker's favorite terrain.
- High value, foreign currency, cross-border: A single scrap lot or billet order runs six to seven figures in EUR/USD. A cross-border transfer is the hardest money movement to recall; one successful attack can wipe out a year's profit.
- The trader and agent layer: The producer often corresponds not with the cargo's actual owner but with the trader in between. Every additional link is an extra surface where identity verification gets harder — when "the trader's email" is compromised, both sides may not notice for weeks.
2. The Four Threat Vectors We See in the Sector
2.1 Proforma / Bank-Change Fraud
The opening scenario. The most expensive vector: a "our bank details have changed" proforma is inserted into the middle of a genuine supply conversation, from a compromised trader account or a look-alike domain one letter off. Nothing in the content is malicious; tonnage, ports, Incoterms — all correct. Because the attacker has been reading the real correspondence for weeks.
2.2 BEC Under Spot-Opportunity Pressure
From the "General Manager" to foreign trade: "Let's not miss this price — send the deposit today, we'll talk when I'm back." The commodity market's real urgency camouflages the fake one — in this sector, "it must be paid today" sounds odd to no one. The attacker exploits exactly this normality.
2.3 Letter-of-Credit and Bill-of-Lading Document Lures
LC transactions generate heavy bank/document traffic. Emails themed "bill of lading attached" or "your LC amendment awaits approval" open onto malicious attachments, fake bank portals, or credential-harvesting pages. Foreign-trade teams are so accustomed to this document flow that reflexive click rates run high.
2.4 Double-Sided Fraud via Account Takeover
A compromised foreign-trade account gives the attacker both directions at once: writing "our account has changed" to customers redirects receivables; placing fake orders with suppliers redirects the goods. Gateway-based protections can't see this internal/outbound traffic; we explained the architectural difference in our API vs Gateway article.
3. Field Note: The Speed Culture and the Death of Verification
The pattern we see again and again in Türkiye's iron & steel field: attacks coincide with the weeks when price volatility hardens. When scrap falls fast there's a rush to "lock in stock"; when it rises fast, to "lock the price" — the attacker learns this rhythm by watching the market like everyone else, and times the strike for the day when "if we don't pay today, the price is gone" is most believable. A second observation: trader correspondence often rests on personal relationships ("Mehmet Bey's email") with no domain/address checking; look-alike domains go almost entirely unnoticed in this sector.
4. Defense: Three Layers Without Killing the Speed
Process
The single bulletproof rule can be applied without breaking spot speed: every payment instruction containing a bank/IBAN change, and every transfer above a set amount, is not processed without a call-back to a pre-registered number, independent of email. That call takes 3 minutes; a spot price doesn't run away in 3 minutes — but a six-figure EUR, once gone, doesn't come back.
Technology
Check Point Harmony Email & Collaboration provides the following in these sector scenarios:
- Look-alike and newly registered domain detection — a "this trader domain was registered 6 days ago" warning makes single-letter games visible.
- Correspondence-pattern learning — contextually flags tone/request deviations in a months-long trader relationship (a sudden bank change, unusual urgency).
- Attachment and link analysis on LC/bill-of-lading lures: sandboxing + click-time protection.
- Scanning all inbound, outbound, and internal traffic — also catching the "our account has changed" email going from a compromised account to your customers.
People
Sector-specific simulations for foreign-trade and finance teams: a fake proforma, a fake LC amendment, spot-pressure BEC. Not generic training — a replica of their own workflow.
Frequently Asked Questions
We work with letters of credit — why should wire fraud concern us?
An LC raises payment security but doesn't zero out email risk: deposits/advances, off-LC spot purchases, and freight/commission payments usually still move by wire. And the LC document traffic itself (amendment approvals, bills of lading) is used as lure material.
If our trader's email is compromised, what can our protection do?
This is exactly the scenario that requires a behavioral layer: even when the sender is "real," a bank-detail change, a reply-to deviation, and a tonal shift are flagged contextually. And the second-channel confirmation rule protects you independently of the other side's security.
We're a small service center / pipe producer — are we a target?
Yes — the attacker looks not at revenue but at the size moving in a single transaction and the weakness of confirmation processes. Mid-size service centers are frequent targets: high-value purchases, immature processes.
Can we measure what our current protection misses in these scenarios?
Yes. In a 14-day monitor-mode trial, without touching your existing protection, we report the missed threats — including supplier/trader impersonation, look-alike domains, and BEC.
What Should You Do Now?
If your spot purchases and high-value FX transfers are managed over email, one question is worth measuring: "If a bank-change email arrived, would our system and our process catch it?"
- Free Field Audit: Your SPF/DKIM/DMARC report card, look-alike domain risks, and trader/supplier impersonation exposure.
- 14-Day Check Point Trial (monitor mode): Missed threats reported without touching your existing protection.
About this article: The fourth article of our Sector Series. Kinetik Bilişim is the Türkiye partner of Check Point Software Technologies at the Advanced Partner 2026 level, holding Email, Endpoint & Browser, Mobile, and SASE Solution Specialization accreditations. The author, Kemal Özleyen, is a cybersecurity engineer certified as a Check Point Workspace Security Expert. Field scenarios are shared in anonymized form.
