CMA CGM Bill of Lading Email Scam: Fake Shipping Login Page Fully Exposed

A draft Bill of Lading can affect cargo release, customs paperwork, and delivery schedules. That makes an unexpected review notice difficult for shipping staff to ignore.

The message looks operational rather than dramatic. Its danger sits behind the document button, where the normal freight workflow quietly changes direction.

Overview

A Shipping Document That Appears Time-Sensitive

The CMA CGM Bill of Lading email scam claims that a draft transport document is ready for the recipient’s review.

It includes a booking reference and B/L number, often repeating the same value. Those identifiers make a mass-produced email look connected to real cargo.

The recipient is invited to manage the draft and request amendments. That is a familiar task for importers, exporters, freight forwarders, and logistics teams.

A Bill of Lading is important paperwork. It describes a shipment and may serve as a receipt, contract evidence, or document of title.

Because errors can delay goods, recipients may prioritize the message before checking whether the booking actually belongs to them.

The Document Portal Is Not a Carrier Service

The button leads away from the carrier’s genuine systems. The destination presents a webmail sign-in form instead of a shipping record.

That change is the central deception. Reviewing freight paperwork should not require giving an outside website the password to an email account.

The counterfeit form may claim the document is protected or linked to the recipient’s mailbox. No technical necessity supports that explanation.

Credentials submitted there can be captured by the operator. The visitor may see an error, empty file, or harmless redirect afterward.

CMA CGM is a real international shipping company. Its identity is being impersonated and does not legitimize the email.

The Likely Goal Is Business Email Compromise

A logistics mailbox can contain commercial invoices, supplier details, arrival notices, payment instructions, customs records, and ongoing negotiations.

• The lure refers to an ordinary shipping task.
• Booking and B/L numbers add false precision.
• A review deadline is implied by cargo operations.
• The button directs users outside the real carrier.
• The destination requests business email credentials.
• Stolen correspondence reveals vendors and payment routines.
• Attackers can alter future invoices or delivery instructions.

A compromised mailbox can become a platform for payment diversion. Criminals may wait for the right conversation before inserting replacement banking details.

The email therefore threatens more than one login. It can expose an entire commercial relationship and the organizations connected to it.

How the CMA CGM Bill of Lading Email Scam Works

Step 1: The Email Selects a Specialized Business Story

Rather than using a generic parcel notice, the campaign mentions a draft Bill of Lading. The vocabulary targets people accustomed to international shipping paperwork.

Specialized language raises credibility because outsiders may assume only a real carrier would use it. In practice, terminology is easily copied from genuine notifications.

The recipient may handle dozens of active bookings. A number that looks plausible can blend into daily operations even when it matches nothing.

Attackers benefit from uncertainty. Employees often open the document first, expecting the contents to identify the shipment.

Step 2: Reference Numbers Simulate a Real Record

The message displays a booking reference and a B/L number. Repeating a random identifier is inexpensive but gives the layout an automated appearance.

True shipment identifiers can be checked through an official carrier portal. The email does not need to control where that verification happens.

A false notice keeps all validation inside its own button. This prevents the recipient from noticing that the booking is absent from the legitimate account.

Companies should never treat a number as proof by itself. A convincing format cannot demonstrate who generated the record.

Step 3: Cargo Urgency Discourages Independent Checking

Draft corrections often have operational deadlines. A reader may fear demurrage, customs trouble, document fees, or a delayed release.

The scam does not need to state a countdown. The business context already supplies pressure for anyone responsible for the shipment.

Criminals exploit that professional reflex. Fast service is usually valuable, yet urgency becomes dangerous when it replaces authentication.

A brief check against the transport management system can resolve the uncertainty without touching the email’s link.

Step 4: The Manage Button Crosses Into an Unrelated Domain

The “Manage Draft BL” control disguises its destination. Hovering over it can reveal a host with no valid relationship to the carrier.

Some campaigns use recently created domains, compromised websites, or cloud hosting. Others add redirects to make the final location less obvious.

The page may still display cargo imagery and professional navigation. Attractive design is content, not proof of ownership.

Even a valid certificate confirms only encrypted transport. It does not confirm that the website belongs to the shipping company named in the email.

Step 5: The Portal Converts Document Access Into Email Login

Instead of showing shipment details, the site asks for a business email address and password. This request has no legitimate freight purpose.

The carrier does not need the private password of a customer’s Microsoft, Google, or hosted mailbox to display a transport document.

Victims may accept the form because companies use single sign-on. Genuine single sign-on redirects to the organization’s trusted identity provider.

A page under an unknown domain cannot become an approved identity provider simply by copying familiar fields and colors.

Step 6: The Intruder Studies Commercial Conversations

Once inside, the criminal can search for invoices, quotations, purchase orders, shipment schedules, and names of people authorized to approve changes.

The operator may remain quiet while learning language and timing. A carefully timed reply inside a real thread can redirect a substantial payment.

Forwarding rules can send selected messages to the attacker. Filters may hide replies containing words such as “bank,” “invoice,” or “payment.”

The compromised address can also target customers and agents. Those recipients see a genuine domain, established history, and relevant subject matter.

How to Check a Bill of Lading Notice Safely

Search the Official Carrier Account

Open the carrier website from a saved bookmark or manually typed address. Sign in through the normal business portal, not through the message.

Enter the booking reference in the genuine system. Confirm the shipper, consignee, voyage, container, and document status against internal records.

If no matching booking exists, preserve the email and contact the carrier through its published support channel.

Compare the Booking With Internal Systems

Check the transport management system, purchase order, freight forwarder correspondence, and expected sailing schedule. A real draft should connect to known business activity.

Ask the employee or agent responsible for that route. Verification through an existing contact is safer than replying to the unexpected sender.

Pay attention when the same number appears in multiple fields. That shortcut can indicate a template populated without authentic shipment data.

Examine Sender Authentication and Link Ownership

Open the full headers and review the sending domain, Reply-To value, and authentication results. Misalignment supports the impersonation finding.

Preview the action button and identify the registered domain. Cargo words in a subdomain do not establish carrier ownership.

Remember that compromised legitimate sites can host phishing. Domain age or HTTPS alone cannot replace confirmation through the real account.

Call a Known Logistics Contact

Use a telephone number from a signed contract, official carrier directory, or established address book. Do not use numbers introduced by the questionable message.

Read the booking reference and ask whether a draft was issued. The real contact can confirm the proper portal and expected sender.

If a payment instruction changed, confirm it verbally with an authorized person. Treat email-only banking changes as a separate fraud risk.

What to Do If You Fell Victim to the Bill of Lading Scam

Act promptly, especially when the affected mailbox handles payments or shipping instructions. A fast response can interrupt both account theft and follow-on fraud.

1. Disconnect from the phishing page and document what occurred.

   Close the site and record the URL, email subject, time, and information entered. Keep the original headers available for investigators.

   Notify the company security team and logistics manager. They may need to warn other recipients, carriers, and business partners.

2. Reset the business email password through the official administrator.

   Use a known-clean device or trusted corporate route. Set a unique credential that does not resemble the exposed one.

   Change reused passwords on other services immediately. Shipping portals, accounting systems, and cloud drives deserve early attention.

3. Terminate sessions and revoke unauthorized applications.

   Review current sessions, OAuth grants, application passwords, mobile connections, and registered devices. Remove entries that cannot be traced to approved use.

   Invalidate all sessions where possible. Ask the administrator to review identity-provider and mail-server logs around the interaction time.

4. Audit forwarding rules and financial conversations.

   Search for hidden forwarding, unfamiliar delegates, inbox rules, and deleted alerts. Examine recent sent messages for unauthorized replies.

   Review invoices and payment-change discussions from the affected account. Contact counterparties through established numbers if anything appears unusual.

5. Strengthen authentication and approval controls.

   Enable a passkey, hardware security key, or authenticator-based multifactor protection. Remove weaker fallback methods that are not required.

   Require a second channel for banking changes. No employee should approve replacement payment instructions from email alone.

6. Check any downloaded material for malware.

   This campaign seeks credentials, but shipping lures also distribute malicious archives and documents. Use Malwarebytes for a complete scan after opening files.

   AdGuard can help stop known phishing hosts and malicious advertising. Keep the browser, filters, operating system, and security tools updated.

7. Alert partners and pursue financial recovery quickly.

   Tell carriers, customers, and agents if fraudulent mail left the account. Use verified contacts and clearly identify the compromised time window.

   If money moved, call the bank’s fraud department immediately and request a recall. Preserve invoice versions, headers, transfer records, and communication logs.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Why Shipping Operations Are Valuable Targets

Logistics connects many independent organizations. A single shipment can involve sellers, buyers, carriers, ports, brokers, warehouses, and financial institutions.

That complexity creates many believable reasons for unexpected documents. Employees cannot personally recognize every party whose name appears in a transaction.

Messages also cross time zones. A recipient may feel responsible for resolving an issue before another office closes.

Freight paperwork contains useful operational details. Criminals can reuse those details to make later impersonation more accurate.

Shipping mailboxes frequently exchange attachments. Staff become accustomed to opening PDFs, spreadsheets, and archive files from outside the organization.

Payment amounts can be substantial. Redirecting one freight invoice may produce a larger return than stealing many consumer accounts.

Attackers exploit process gaps, not just technical weaknesses. Unclear ownership and hurried approvals make a false document easier to introduce.

A reliable verification routine removes that advantage. Every booking should be traceable through an independent system before credentials or money move.

Practical Protections for Logistics Teams

Maintain a directory of approved carrier domains, portals, and support contacts. Make it accessible to employees handling shipments outside normal hours.

Link every document review to an internal booking record. An email without a matching shipment should stop rather than accelerate the process.

Separate mailbox access from document access. External suppliers should never ask employees to provide corporate email passwords on vendor-hosted pages.

Use phishing-resistant multifactor authentication for finance and logistics accounts. These mailboxes deserve the same protection as direct banking systems.

Monitor new forwarding rules, delegates, and suspicious OAuth permissions. Quiet persistence can outlive a simple password reset.

Require verbal confirmation for bank changes, refunds, and unusual release instructions. Call a stored number, not one included in the latest email.

Configure banners for external senders, but teach staff that banners are context rather than a final verdict. Compromised partner mailboxes remain dangerous.

Run short simulations using realistic freight scenarios. Training should practice the correct verification path, not merely ask employees to spot spelling mistakes.

Centralize incident reporting. One employee’s quick report can protect every office receiving the same booking reference.

After an incident, review both identity logs and commercial consequences. Investigators must determine whether instructions, invoices, or relationships were manipulated.

Frequently Asked Questions

Is CMA CGM responsible for this Bill of Lading email?

No. Fraudsters are borrowing the identity of a legitimate carrier. The unrelated login destination is controlled outside the genuine shipping workflow.

Why does the email include a booking reference?

A reference number makes the notice feel automated. It proves nothing until it matches a shipment inside the official portal and internal records.

Should a carrier ask for my email password?

No external carrier needs the private password for your company mailbox. Approved single sign-on should use your organization’s recognized identity provider.

What if the shipment details seem familiar?

Verify them independently. Criminals can copy real details from compromised accounts, leaked documents, or earlier conversations.

Can this scam lead to invoice fraud?

Yes. Mailbox access can reveal payment discussions and let attackers introduce false bank details inside convincing commercial threads.

What should I do after clicking without entering credentials?

Close the site, report the message, inspect downloads, and remove unexpected browser permissions. Escalate if any file executed or information was submitted.

The Bottom Line

The CMA CGM Bill of Lading scam turns ordinary freight paperwork into a gateway for stealing a business mailbox and studying commercial relationships.

Match every booking through the official portal, confirm unfamiliar requests with known contacts, and never provide an email password to a shipping document page.