Payment & terms
The supplier has sent new bank details. What do you do before you pay?
Last updated
Sinospect checks both companies at their registers, compares the new payment instructions with the contracting entity’s records and calls back on an independently sourced number where one is listed; findings in 48 hours. Have the new account checked →
Why does a change of bank details deserve a hold?
A fraudulent request can arrive between the deposit and the balance, when the relationship feels established and the shipment date is close. It may come from the supplier’s own address, or one character away from it, quote the real order number and give a reason: the old account is under audit, the bank has changed, payments now go through the Hong Kong company. Every detail in it may be accurate except the account.
This is business email compromise. The attacker may have read the correspondence, either from inside the supplier’s mailbox or from inside yours, and waited for the invoice that matters.
The defence does not depend on spotting the fake. It depends on a rule that applies to every change, genuine or not: a bank-detail change is verified outside the email thread before anything is paid.
How do you verify the new account before paying?
- Hold the transfer and tell finance in writing that the beneficiary has changed, so nobody pays on the old approval.
- Call the supplier by voice on a number you already held before the change, or on the switchboard number listed on the company’s registry record. Never use a number, a WeChat account or a link taken from the email that announced the change. Ask for the account details to be read back, not confirmed with a yes.
- Compare the account name with the registered name of the company you contracted with. A Mainland company registers its name in Chinese characters, and an English name on a payment instruction is the company’s own translation, so ask for both in its written instruction. Treat any other difference — an abbreviation, a different trading name, a person’s name or another company — as a discrepancy to resolve before paying, whatever the explanation.
- Match the bank and the jurisdiction with the company’s seat. A Mainland factory collecting in Hong Kong, Singapore or Indonesia needs the collecting entity read at its register and tied to the factory before any payment.
- Ask for a written instruction on the company’s letterhead, bearing the company chop and signed by the legal representative, and keep it with the order file. A chop can be forged, so the document is a record rather than proof; the independent call and the name comparison carry more weight, although neither proves who owns the account.
- Record who requested the change, who verified it, on which number, and who approved it. Have two people on your side approve it, not one.
| Signal | What it may indicate | What to do |
|---|---|---|
| Account name differs from the contracting company | Possible fraud, or a collection entity not yet verified | Hold the payment. Check the named entity at its register and establish its link to the contracting company before paying |
| Personal account for a company order | Possible fraud, or a payment outside the company’s own accounts | Hold the payment until the contracting company gives authorised written instructions for an account in its own name |
| Reason given: old account frozen, audited or closed | A reason that can accompany fraud, and is sometimes true | Verify exactly as for any change; the reason changes nothing |
| Urgency: pay today to hold the production slot or the sailing | Pressure to skip the call | Make the call before paying; urgency does not replace verification |
| Change announced by email only, sender address subtly different | Mailbox spoofing or compromise | Treat the whole thread as untrusted; verify by voice on a known number |
What if the new account is in Hong Kong, in another company’s name, or in a person’s name?
Many Mainland manufacturers contract and collect through a Hong Kong company, and a genuine switch to that company’s account does happen. It is still a change of counterparty, and it is verified as one: the Hong Kong company is checked at the Companies Registry, its directors and shareholders are compared with the factory’s record, and the account name is compared with its registered name. Where the registers show common control, the buyer can decide whether to accept the change on that record and the written instruction on file, ideally with the Hong Kong company added to the agreement as co-signatory. Where no link appears on either register, the supplier’s explanation is not evidence, and the payment waits.
A third company with no documented relationship to the contract, or a personal account, is not paid on the strength of an email. The payment stays on hold until the contracting company gives authorised written instructions for an account in its own name or in the name of a verified related company. See how a Hong Kong company is verified and how a deposit is protected before it moves.
What if the payment has already been sent?
Speed matters. Call your bank and ask for a recall of the transfer before you do anything else; funds that have not yet been moved on may still be frozen, and every delay reduces what can be recovered. Then report the case to the police, keep every message and header, and tell the genuine supplier by voice, because their mailbox may be the one that was compromised. A due-diligence report on the receiving entity records what the registers show about the named beneficiary and can support a demand letter or a complaint; it does not recover the money by itself.
How Sinospect handles this
When a supplier you already work with sends new bank details, Sinospect runs a beneficiary-and-entity check in 48 hours for USD 190: both companies’ standing checked at their registers on the search date, the account name in the new instructions compared with the contracting entity’s records, the findings of a call-back on an independently sourced company number where one is listed, and a written confirmation of the change requested from the legal representative, with the response placed on your file. When the payment is the first one to a supplier you have not met, the full pre-payment due diligence applies: both entities, the account, the negotiator, factory capability, and a verdict with the conditions to write into the order. Either way the buyer’s identity and purpose stay confidential, and the report states what the record settled and what remains open.
Frequently asked questions
Is a change of bank details always fraud?
No. Suppliers do change banks, open a Hong Kong collection account, or move to a new entity after a restructuring. Assess the change using evidence obtained outside the email thread: a voice confirmation on a known or registry-listed number, a written instruction bearing the company chop, and an account name consistent with the contracting company's registered name.
The supplier says the old account is frozen or under audit. Is that plausible?
It can be true, and it is also a reason given in this kind of fraud. Treat it the same way either way: it changes nothing about how you verify. A frozen account does not stop a company from confirming a new one by voice and on paper, and it does not explain why the new account should belong to a different company or a person.
Should I send a small test payment to the new account first?
A test transfer proves the account exists and that someone at the other end can see it arrive; it does not prove who owns it. Use it, if at all, only after the name match and the voice confirmation, and confirm receipt through the same independent channel, not by replying to the email that announced the change.
What if the new account is in Hong Kong, in another company's name, or in a person's name?
A personal account for a company order should put the payment on hold until the contracting company gives authorised written instructions for an account in its own name. A Hong Kong or third-company account needs the entity checked at its register and its link to the factory established before you pay; the supplier's word that it is their collection company is not evidence. Sinospect's Hong Kong company check examines that registry record and those links and reports its findings.
How fast can a new account be checked?
Sinospect runs a beneficiary-and-entity check in 48 hours for USD 190: both entities' standing at their registers, the account name in the new instructions compared with the contracting company's records, the findings of a call-back on an independently sourced company number where one is listed, and a written confirmation of the change requested from the legal representative, with the response recorded. For a first payment to a supplier you have not met, the full pre-payment due diligence applies instead.
New bank details on the table and a payment due?
Send the message that announced the change, the old and new account details and the contract. Sinospect tells you within one business day what it can establish and returns its findings in 48 hours.