# Payment fraud China trade email scam: how the email hack works and how to stop it
The email looks exactly like your supplier's. Same name, same signature, same thread you have been discussing the order in for weeks. It says the factory changed banks and asks you to send the balance to a new account. You wire the money. Days later your real supplier asks where the payment is. The payment fraud China trade email scam succeeds because it targets the one moment in a transaction when everyone is in a hurry: the payment. This guide explains how the scam runs, why even careful importers fall for it, and the specific controls that stop it cold.
How the email-hack scam actually works
The payment fraud China trade email scam has a simple shape with a few variations. Criminals gain access to an email account, either your supplier's or yours, often through phishing. They do not announce themselves. They sit quietly in the mailbox for days or weeks, reading threads, learning who handles payments, noting the tone of the conversation and the timing of the order. Then, at the payment moment, they strike.
The classic version is the bank-change notice. A message arrives in the middle of a real thread, appearing to come from your supplier's sales contact, saying the company has changed its bank account and providing new wire details. The payment fraud China trade email scam depends on this moment feeling routine: the email address is usually off by one character, or it is the genuine address sent from a compromised account. The scammer may attach a convincing-looking bank letter with the company chop. Everything feels routine, and routine is the point.
Variations include the urgent-balance scam, where a message pressures you to pay the balance immediately to catch a shipping deadline, and the split-payment scam, where you are told to send part of the payment to a second account for "tax reasons." Some operations compromise the buyer's email instead and send fake instructions to the supplier, or impersonate the buyer's finance department to redirect refunds. The details change; the mechanism is always the same. The payment fraud China trade email scam inserts a fake instruction into a trusted conversation at the exact moment money is supposed to move.
Why does it work so well? Because wire transfers to China feel irreversible, and they nearly are. Once the money lands in a scammer's account, it is moved within hours through a chain of accounts. Your bank can try to recall the transfer, but recalls across borders succeed only in a narrow window and often fail. The scammer's entire business model depends on you sending the money before anyone double-checks.
Why careful importers still fall for the payment fraud China trade email scam
Nobody plans to be scammed, and the victims are not careless beginners. The scam succeeds because it exploits normal business behavior.
First, it arrives inside trust. The message comes through a channel you have used for months, references real order numbers, and uses the contact's real name. Your brain processes it as a continuation of a trusted conversation, not as a new claim that needs verification. The payment fraud China trade email scam never introduces itself; it inherits trust, which is why even skeptical people comply.
Second, it exploits urgency. Payment messages always come with a deadline: the container leaves Thursday, the factory needs the balance to release goods, the bank details expire. Urgency short-circuits verification. The whole design of the scam is to make you feel that checking would cost you the shipment.
Third, it exploits the authority gap. Junior finance staff often process payment instructions from "the supplier" without questioning them, and owners often forward supplier emails to finance with a one-line "please pay." Nobody in the chain feels authorized to slow things down by asking whether the bank really changed.
Finally, the fakes have gotten good. Scammers copy signatures, letterheads, and company chops from real documents in the compromised mailbox. A bank-change notice that includes your real order number, your real contact's name, and a plausible bank letter passes a casual glance. Casual glances are all most payment processes get, and the payment fraud China trade email scam is built to survive exactly that level of scrutiny.
The controls that stop the payment fraud China trade email scam
Stopping the payment fraud China trade email scam is not about better antivirus software. It is about payment procedures that do not depend on any single message being genuine. Four controls, used together, close the scam down.
Control one: fix the payment account in the contract. Write the supplier's receiving bank account into the manufacturing agreement or the PI, and add a clause stating that the account can only be changed by a signed amendment delivered through a previously verified channel. When the account is contractual, any email claiming a change is automatically suspect.
Control two: verify every change out of band. If you ever receive a bank-change notice, do not reply to the email and do not use the phone number in the email. Call your supplier's known landline, the number you have used before and can find independently, and speak to a person you have spoken to before. Confirm the change verbally and ask for written confirmation on company letterhead sent to your verified address. This one habit stops the vast majority of payment fraud China trade email scam attempts, because scammers cannot answer your supplier's real phone.
Control three: look before you send. Check the sender's exact email address, character by character, before every payment. Scammers rely on lookalike domains: a substituted letter, an extra hyphen, a different top-level domain. Make this a checklist item in your payment process, not a vague intention. One minute of checking beats months of recovery.
Control four: separate the roles. The person who receives supplier emails should not be the same person who authorizes wires, or at minimum, every payment above a threshold should need a second pair of eyes. A second person checking the account details against the contract catches what the first person missed. This is basic, it is slightly annoying, and it works.
What to do in the first hour if you already sent it
If you realize the money went to the wrong account, speed is everything. The payment fraud China trade email scam succeeds on delay, so your response has to be faster than the scammer's money movement. Every hour you wait is an hour the funds spend moving through accounts you cannot reach.
Call your bank immediately and request a recall or stop on the wire transfer. Provide the transfer reference, the amount, the date, and the receiving account details. Banks have fraud teams for exactly this, and the sooner they act, the better the odds. Be direct about what happened: "I was the victim of a business email compromise and wired funds to a fraudulent account."
Contact the receiving bank as well, if you can identify it, and ask their fraud department to freeze the receiving account. This works better with a police report in hand, so file one promptly, both with your local police and, if practical, with the authorities where the receiving account sits. In China, that means reporting to the public security bureau in the relevant jurisdiction; a local lawyer can help you file correctly.
Notify your real supplier at once through a verified channel. They need to know their email may be compromised, and they may be able to help identify where the breach happened. Preserve everything: the fraudulent email with full headers, your transfer records, and the timeline. Do not delete anything.
Be honest with yourself about the odds. Fast action sometimes recovers the money; slow action almost never does. Either way, fix the procedures that allowed it before the next payment is due.
Building a payment process the scam cannot beat
The long-term fix is to make verification automatic rather than heroic. Build these into how your company pays suppliers, so the payment fraud China trade email scam fails against your process even on a bad day, even when the person processing the payment is new, tired, or rushed.
Keep a supplier master file with verified bank details for every supplier, updated only through the out-of-band verification process described above. Every payment gets checked against the master file, not against the latest email. When the details do not match, payment stops until the mismatch is resolved.
Set a payment calendar and stick to it. Scammers manufacture urgency; a fixed schedule deflates it. If the balance is due on the 15th against an accepted inspection report, a frantic email on the 12th demanding immediate payment to a new account is obviously wrong.
Train everyone who touches payments. Walk your finance team through a real example of the scam, show them what a lookalike domain looks like, and give them explicit permission to delay any payment that feels off. The most expensive sentence in importing is "I thought it was fine, so I sent it." Replace it with a culture where pausing a payment to verify is always the right call. That culture is the final defense when every technical control in the payment fraud China trade email scam playbook has been anticipated.
Review the process yearly. Scammers adapt, and so should you. A short annual review of your payment controls, ideally tied to your contract renewal cycle, keeps the defenses current.
Conclusion
The payment fraud China trade email scam is not a technical problem; it is a procedure problem. Scammers hijack trusted conversations and manufacture urgency because those two things defeat casual verification. The defense is equally simple: contractual bank accounts, out-of-band verification of any change, character-level email checks, and separation of payment roles. Importers who build these controls into their process do not get hit, not because they are smarter, but because their process makes the payment fraud China trade email scam's one move impossible. Set it up now, before the email arrives.
Frequently asked questions
### Can my bank reverse a wire sent to a scammer?
Sometimes, if you act within hours. Your bank can request a recall, and the receiving bank can freeze the account if the funds are still there. Success rates drop sharply with time, so treat the first hour as the window that matters.
### How do I know if my supplier's email was hacked?
Signs include bank-change notices you did not expect, messages with slightly wrong email addresses, unusual urgency around payments, and your supplier denying they sent something you received. Ask your supplier to check their sent folder and login activity.
### Should I use escrow or a letter of credit instead?
Both add protection for larger orders by putting a bank between you and the payment, but they add cost and complexity. For most importers, strong verification procedures plus contractual bank accounts handle the risk more cheaply. Discuss the trade-offs with your bank for high-value orders.
### Does this payment fraud China trade email scam only target China trade?
No. Business email compromise hits every industry and every trade lane. It is especially common in China trade because of the volume of wire transfers, the time zone gap that slows verification, and the language barrier that makes fake documents harder to spot.
### What if my supplier really did change banks?
It happens. Verify through the out-of-band process: call the known number, speak to a known person, get written confirmation on letterhead, and update the contract or PI. A real bank change survives verification; a scam does not.