Payment & terms
The supplier has sent new bank details. What do you do before you pay?
Last updated
Sinospect reads both companies at their registers, matches the account to the contracting entity and confirms the change by voice, in 48 hours. Have the new account checked →
Why does a change of bank details deserve a hold?
The message usually arrives between the deposit and the balance, when the relationship feels established and the shipment date is close. It comes from the supplier’s own address, or one character away from it, quotes the real order number, and gives a reason: the old account is under audit, the bank has changed, payments now go through the Hong Kong company. Everything in it is true except the account.
This is business email compromise, and it is the payment fraud that costs buyers most. The attacker has read the correspondence, either from inside the supplier’s mailbox or from inside yours, and waits for the invoice that matters. The Riyadh Chamber of Commerce warned its members about the same pattern in 2011: a new account number requested at the second payment, then a claim that the supplier’s email had been hacked. Losses in the published cases run from a few tens of thousands of dollars to several million, and the money moves through Hong Kong, Indonesian or Mainland accounts within hours of the transfer.
The defence does not depend on spotting the fake. It depends on a rule that applies to every change, genuine or not: a bank-detail change is verified outside the email thread before anything is paid.
How do you verify the new account before paying?
- Hold the transfer and tell finance in writing that the beneficiary has changed, so nobody pays on the old approval.
- Call the supplier by voice on a number you already held before the change, or on the switchboard number listed on the company’s registry record. Never use a number, a WeChat account or a link taken from the email that announced the change. Ask for the account details to be read back, not confirmed with a yes.
- Match the account name, character for character, with the registered legal name of the company you contracted with. An abbreviation, a trading name, a person’s name or a different company is a mismatch, whatever the explanation.
- Match the bank and the jurisdiction with the company’s seat. A Mainland factory collecting in Hong Kong, Singapore or Indonesia needs the collecting entity read at its register and tied to the factory before any payment.
- Ask for a written instruction on the company’s letterhead, bearing the company chop and signed by the legal representative, and keep it with the order file. A chop can be forged, so this is the record, not the proof; the voice call and the name match are the proof.
- Record who requested the change, who verified it, on which number, and who approved it. Two people on your side, never one.
| Signal | What it usually means | What to do |
|---|---|---|
| Account name differs from the contracting company | Fraud, or a collection entity you have never verified | Stop. Read the named entity at its register and tie it to the factory before paying |
| Personal account for a company order | Fraud, or a supplier operating outside its own books | Do not pay. There is no version of this that a buyer should fund |
| Reason given: old account frozen, audited or closed | The standard cover story, occasionally true | Verify exactly as for any change; the reason changes nothing |
| Urgency: pay today to hold the production slot or the sailing | Pressure to skip the call | Make the call anyway; a genuine supplier will wait a day |
| Change announced by email only, sender address subtly different | Mailbox spoofing or compromise | Treat the whole thread as untrusted; verify by voice on a known number |
What if the new account is in Hong Kong, in another company’s name, or in a person’s name?
Many Mainland manufacturers contract and collect through a Hong Kong company, and a genuine switch to that company’s account does happen. It is still a change of counterparty, and it is verified as one: the Hong Kong company is read at the Companies Registry, its directors and shareholders are compared with the factory’s record, and the account is matched with its registered name. Where the two companies are under common control, the change can be accepted with the written instruction on file and, ideally, the Hong Kong company added to the agreement as co-signatory. Where no link appears on either register, the supplier’s explanation is not evidence, and the payment waits.
A third company with no relationship to the contract, or a personal account, ends the discussion. Nothing a supplier says by email can make a buyer’s payment to a stranger safe, and a supplier that insists on it has told you what you needed to know. See how a Hong Kong company is verified and how a deposit is protected before it moves.
What if the payment has already been sent?
Speed decides what can be recovered. Call your bank and ask for a recall on the transfer before you do anything else; the receiving bank can freeze funds that have not yet been moved on, and the window is measured in hours. Then report the case to your police, keep every message and header, and tell the genuine supplier by voice, because their mailbox may be the one that was compromised. A due-diligence report on the receiving entity identifies who was paid and supports a demand letter or a complaint; it does not bring the money back on its own, and for sums below a few tens of thousands of dollars, recovery through the courts rarely pays.
How Sinospect handles this
When a supplier you already work with sends new bank details, Sinospect runs a beneficiary-and-entity check in 48 hours for USD 190: both companies’ standing read live at their registers, the account name matched to the contracting entity, a call-back on the registry-listed number, and a written confirmation of the change obtained from the legal representative and placed on your file. When the payment is the first one to a supplier you have not met, the full pre-payment due diligence applies: both entities, the account, the negotiator, factory capability, and a verdict with the conditions to write into the order. Either way the supplier is not told a check is running, and the report states what the record settled and what it could not.
Frequently asked questions
Is a change of bank details always fraud?
No. Suppliers do change banks, open a Hong Kong collection account, or move to a new entity after a restructuring. What separates the genuine change from the fraud is evidence you obtain outside the email thread: a voice confirmation on a known or registry-listed number, a written instruction bearing the company chop, and an account name that matches the contracting company's registered name.
The supplier says the old account is frozen or under audit. Is that plausible?
It is the most common story in the fraud and, occasionally, true. Treat it the same way either way: it changes nothing about how you verify. A frozen account does not stop a company from confirming a new one by voice and on paper, and it never explains why the new account should belong to a different company or a person.
Should I send a small test payment to the new account first?
A test transfer proves the account exists and that someone at the other end can see it arrive; it does not prove who owns it. Use it, if at all, only after the name match and the voice confirmation, and confirm receipt through the same independent channel, not by replying to the email that announced the change.
What if the new account is in Hong Kong, in another company's name, or in a person's name?
A personal account for a company order is the clearest signal you will get and should stop the payment. A Hong Kong or third-company account needs the entity read at its register and tied to the factory before you pay; the supplier's word that it is their collection company is not evidence. Sinospect's Hong Kong company check does exactly that.
How fast can a new account be checked?
Sinospect runs a beneficiary-and-entity check in 48 hours for USD 190: both entities' standing at their registers, the account name matched to the contracting company, a call-back on the registry-listed number, and a written confirmation of the change obtained from the legal representative. For a first payment to a supplier you have not met, the full pre-payment due diligence applies instead.
New bank details on the table and a payment due?
Send the message that announced the change, the old and new account details and the contract. Sinospect tells you within one business day what it can settle and returns the check in 48 hours.