The invoice looks right, the contact name is the one you've emailed for months, and the order number matches. The only thing different is the bank account at the bottom — and by the time anyone notices, the wire has already gone out. This page covers how supplier payment fraud actually works, why the usual checks miss it, and what verifying a payment before it goes out should look like.
Quick look
• Supplier payment fraud rarely starts with a hacked account. It starts with an email that looks exactly right — same contact, same order number, same signature — except the bank account at the bottom has quietly changed.
• The more advanced version goes further: a cloned website that looks like the real supplier's, a fake pin dropped on the map next to the real factory's address, or a domain spelled with one extra letter or dot.
• That means the three checks most buyers rely on — the supplier's website, its address on the map, and the look of the sender's domain — can each be faked on their own.
• The fix isn't a smarter email filter. It's confirming any bank account change through a channel that has nothing to do with the email itself, before the wire goes out.
What Supplier Payment Fraud Actually Looks Like
The basic version of this is a well-documented pattern known as business email compromise. A scammer intercepts or impersonates a supplier's email thread and, at the point where a deposit or final payment is due, sends a "bank account update" notice. Everything else in the message — the contact name, the order number, the amount, the signature block — stays accurate. Only the account number changes. Because almost everything in the email is real, there's nothing in the message itself that reads as suspicious.
A more advanced version goes further, and it's the pattern that matters most for buyers who think a quick online check is enough to confirm who they're paying:
• A cloned website. A page built to look like the real supplier's official site, sometimes down to the same photos and company description.
• A fake map pin. A location marker added next to the real factory's address, so a quick map search appears to confirm the supplier is exactly where they claim to be.
• A lookalike domain. A sender address that differs from the real one by a single character — an extra dot, an added "s," a swapped letter — close enough that it passes a quick visual check.
The pattern across all three: the checks most buyers already run — search for the company, look up the address on a map, glance at the sender's domain — are exactly the checks this version of fraud is built to pass.
Why "It Looks Legitimate" Isn't a Safe Test
In most companies' payment process, confirming the receiving account means reading what the email says and, at most, glancing at the supplier's website or map listing to feel reassured. Nobody on the payer's side independently verifies the account through a channel that has nothing to do with the email that requested the change. This isn't a case of someone being careless. The process simply never had that verification step built into it — and the fraud is aimed precisely at the checks people already trust.
How to Verify a Payment Before It Goes Out
A few habits close most of the gap described above:
• Treat any bank account change as a phone call, not an email reply. Confirm it through a contact number or channel you already had on file — not one provided in the message announcing the change.
• Verify large payments through a second channel before the wire goes out. A short call or message through an existing point of contact, separate from the email thread, catches most of this before the money moves.
• Check the domain character by character, not by how familiar it looks. An extra dot or letter is easy to miss at a glance and is exactly what this kind of spoofing relies on.
• Treat a map pin as unverified. Anyone can add a location marker near an existing address, so a map listing on its own doesn't confirm a business is real — that confirmation needs to come from a registration or licensing source.
• Verify the supplier exists before the payment goes out, not after something goes wrong. Confirming business registration and that the factory is physically at its registered address belongs in the same step as verifying who's receiving the funds.
How This Is Handled as a Service
This is the reason Orientwings International offers Payment Collection & Disbursement Services (Including Counterparty Background Screening) as its own line of service. Clients who want it can route a supplier payment through us instead of wiring it out directly. Before the funds move, we confirm the counterparty's business registration, verify its registered capital, and check that the factory is physically present at the registered address — the same checks we already run before recommending a supplier, applied to the payment itself. Clients who want it can also lock in an exchange rate ahead of settlement, so the amount on the invoice is the amount that actually gets paid.
This sits alongside the rest of how Orientwings International structures a purchase: on the shipments we purchase, our US entity is the importer of record, and our own company on each side of the Pacific files under its own name.
Common questions from buyers
Does this kind of fraud require hacking into the supplier's email account?
No. Intercepting a thread, impersonating a contact, or sending from a lookalike domain can achieve the same result without ever breaching the supplier's actual system.
The supplier's website looks real and the map address matches — is that enough?
Not on its own. Both a website and a map listing can be duplicated or placed near a real address. Verifying registration through an official source is a separate step that a website or map check doesn't cover.
If we call to confirm the account, does that make the payment completely safe?
No single step removes all risk. Verifying through a channel separate from the email that requested the change substantially lowers the chance of paying the wrong account, which is why it's treated as a required step rather than an optional one.
Is the counterparty background screening service only for large payments?
There's no fixed minimum. Reach out to discuss a specific payment or shipment.
How does the exchange rate lock work?
Clients who want it can lock in a rate ahead of settlement, so the amount that gets paid doesn't shift with the market between invoicing and payment. Reach out for details on a specific transaction.
Talk to us about how you verify a payment before it goes out
This page is part of Orientwings International's buyer and seller resources. If a payment is coming up and you want a second set of eyes on the supplier before the wire goes out, tell us what you're paying and who you're paying it to.
Related reading: Trade Knowledge, Importer of Record On the Ground in Asia: Our Two Companies, Verify a Supplier Before the Deposit Goes Out.