Cross-Border Business Payment Fraud
Importers and exporters are prime targets for supplier impersonation and changed bank details. How cross-border payment fraud happens and the controls that stop it.
Importers, exporters and anyone paying overseas suppliers face a well-organised fraud: criminals impersonate the supplier and redirect payment to their own account. The goods never ship, and the real supplier is still waiting to be paid.
How it happens
- A supplier's email is hacked, and fraudsters watch the conversation. See vendor email compromise.
- A lookalike email domain sends "updated bank details". See lookalike domains.
- A message on WhatsApp from a "new accounts contact". See supplier bank changes on WhatsApp.
- Invoices edited with new account details. See changed bank details fraud.
Controls that stop it
- Verify any change of bank details by phone to a known contact.
- Require two people to approve new payees and large payments.
- Be alert when the account country differs from the supplier's.
- Agree payment procedures in writing with suppliers at the start.
- Protect your own email with strong two-step verification.
Act within hours if you paid the wrong account. Ask your bank to recall the payment and alert the supplier by phone.
Related: business email compromise. For more, see our guide to financial scams.
Frequently asked questions
Why are international payments targeted?
Large amounts, time differences, language barriers and email-heavy communication make verification harder and fraud easier to hide.
What is the most effective control?
Verifying any new or changed bank details by phone on a number you already have, and a second person approving new payees.
The new account is in a different country from the supplier. Is that normal?
It is a strong warning sign. Verify directly with the supplier before paying.
Sources
- Cybersecurity for Small Business, US Federal Trade Commission
- Small organisations guide to cyber security, UK National Cyber Security Centre
- Internet Crime Complaint Center, FBI
