Payment Interception and Document Fraud: Protecting Your Money After the Deposit Clears

Aug 10, 2026

Payment Interception and Document Fraud: Protecting Your Money After the Deposit Clears

 

Read time: 9 minutes |  By: YUPSENI Team

On This Page

  1. I. The Email That Changed the Bank Account
  2. II. A Bill of Lading That Looks Real and Is Not
  3. III. The Forwarder Who Collected the Cargo and Closed the Office
  4. IV. When One Cargo Pays Two Banks
  5. V. The Container Arrived. The Cargo Inside Was Not Yours.
  6. VI. Seven Rules for Protecting a Payment in Transit

A Canadian importer of PVC wall panels had done everything right. Factory verified. Samples approved. Contract signed. Thirty percent deposit wired to the supplier's company account. Production completed on schedule. The day before the 70 percent balance was due, an email arrived from the supplier's usual address with an attachment: a revised invoice with new bank details, explained as a routine account update. The buyer wired USD 52,000 to the new account. The money vanished. The email had not come from the supplier. It had come from a fraudster who had been reading the supplier's email for weeks, waiting for the exact moment a payment was due.

Fifty-two thousand dollars. One email.

This is the second of two articles on fraud in the PVC building material import trade. The first covered supplier-side risks-identity theft, bait-and-switch samples, fake certifications, and the trading company that answers to a factory name. This article covers what happens after the supplier is verified: the interception of payments, the forgery of shipping documents, the freight forwarder who takes the cargo and disappears, and the warehouse financing schemes that sell the same goods to two buyers. It assumes the supplier is genuine. The threat comes from outside the transaction-or from a genuine supplier who finds a way to extract value from a deal after the terms are signed. For the legal framework that governs who holds which documents and when, the payment terms and bill of lading guide provides the full structure.

I. The Email That Changed the Bank Account

The Canadian importer's case is not hypothetical. It is the most common payment fraud in international trade, and it has a name: business email compromise, or BEC. The fraudster gains access to one party's email system-usually the supplier's, because smaller factories run weaker email security than large importers-and reads the correspondence passively for weeks, learning the rhythms of the deal. When a payment is imminent, the fraudster sends an instruction from the compromised account, or from a lookalike address that differs by one character, directing the buyer to send funds to an account the fraudster controls.

The email looks authentic because it comes from an authentic account. The timing is right because the fraudster has been reading the correspondence. The request is plausible because the fraudster has learned the language the supplier uses. The only thing wrong is the bank account number, and a buyer who does not independently verify a change of bank details against a previously confirmed channel has no defence against it.

A variant of this attack targets the buyer's side. The fraudster compromises the buyer's email and sends the supplier a fraudulent purchase order with altered consignee details. The supplier ships to the fraudster's warehouse. The buyer discovers the diversion when the genuine order fails to arrive. Both variants exploit the same vulnerability: a single compromised email account that neither party knows has been breached.

The defence costs nothing

Agree with the supplier, in the first conversation, that bank details will never be changed by email alone. Any change must be confirmed by a second channel-a phone call to a known number, a video call, or a message on a separate platform that was established before the transaction began. If a bank change request arrives and the second channel cannot confirm it within thirty minutes, the money does not move. Fraudsters rely on the buyer's urgency to close the payment. Removing urgency removes the fraud.

II. A Bill of Lading That Looks Real and Is Not

The bill of lading is the document of title. Hold the original, and you hold the right to claim the cargo. Forge it convincingly, and you can sell cargo that does not exist-or sell the same cargo to two buyers at once.

A Nigerian importer of PVC ceiling panels received a scanned bill of lading copy from the supplier showing a container number, a vessel name, a sailing date, and a consignee field matching his company. He wired the 70 percent balance. The vessel existed. The sailing date was real. The container number, when checked against the carrier's tracking system, belonged to a different shipment-a container of ceramic tiles bound for Rotterdam, not PVC ceiling panels bound for Lagos. The bill of lading was a forgery built on a real template, with a real vessel and a real date, and one critical field altered. The supplier had never loaded the goods. The supplier had loaded a story onto a PDF.

Verifying a bill of lading requires contacting the carrier directly-not the freight forwarder, not the supplier, but the shipping line named on the document. Every major carrier maintains a container tracking system accessible by container number. A container number that does not appear in the carrier's system, or that appears but shows a different origin, destination, or commodity, is a bill of lading that should not be paid against. The check takes five minutes. The failure to perform it costs a container.

A subtler variant involves a genuine bill of lading that the supplier refuses to release. The goods are loaded, the vessel sails, the B/L copy arrives, the buyer pays the balance-and the supplier does not send the original. The reason is usually a dispute the supplier has not disclosed: an unpaid sub-supplier, a port fee the supplier disputes, or a tactic to extract an additional payment the contract does not provide for. The buyer has paid for goods they cannot claim. The supplier holds the title document as leverage.

The protection is structural: use a letter of credit that requires the original bill of lading as a presented document, or route payment through a structure where the B/L release and the payment release are simultaneous rather than sequential. The payment terms guide linked above covers both mechanisms.

III. The Forwarder Who Collected the Cargo and Closed the Office

The freight forwarder is the intermediary between the supplier, the carrier, and the buyer. A forwarder who is competent and honest makes international logistics feel invisible. A forwarder who is neither can destroy a shipment.

A US importer of SPC flooring arranged FOB shipment through a forwarder recommended by an acquaintance in the industry. The forwarder quoted a competitive rate, collected the container from the factory, and provided a bill of lading copy. The buyer paid the 70 percent balance. The vessel sailed. When the buyer contacted the forwarder for the original B/L, the phone number was disconnected and the office-a virtual address in Shenzhen-had never physically existed. The container had been diverted at the transshipment port. The cargo was sold to a third party. The buyer had no recourse because the forwarder was not a company in any meaningful sense.

A freight forwarder should be verified with the same rigour as a supplier. Check their business licence. Check their physical office-a virtual address that appears on twenty other company registrations is a pattern, not a coincidence. Ask for references from importers who have used them for at least three shipments. Confirm they are registered with the relevant forwarder association or regulatory body in their country. A forwarder who cannot provide a physical address and verifiable references is a forwarder whose cargo you should not entrust with your money.

A parallel risk is the forwarder who is legitimate but incompetent-the one who consolidates cargo without proper documentation, misses the customs filing deadline, or loses the original bill of lading in their own office. The financial damage is smaller but the operational disruption is real. The same verification that screens out fraud also screens out negligence, because a forwarder with a track record and a physical office has something to lose.

IV. When One Cargo Pays Two Banks

Warehouse receipt fraud-sometimes called double financing-is less common than payment interception but more damaging when it occurs, because it typically involves amounts that are multiples of a single container's value. The mechanism is simple to describe and difficult to detect. A supplier stores a quantity of finished goods in a warehouse, obtains a warehouse receipt documenting the inventory, and uses that receipt as collateral with a bank or a trade finance provider. The same supplier then sells the same goods-or pledges the same receipt-to a second financier, a buyer who has paid in advance, or both. One physical inventory backs two financial claims.

The fraud succeeds because warehouse receipts in some jurisdictions are not centrally registered and are not issued by independent third parties. A receipt issued by a warehouse owned or controlled by the supplier is a document that proves nothing except that the supplier has access to a printer. The buyer or financier who relies on it without independently verifying the physical inventory is lending against paper rather than against goods.

Independent warehouse operators, electronic warehouse receipt systems registered with a central depository, and third-party inventory audits are the defences. None of them is free, and all of them are cheaper than discovering that the goods you financed also belong to a bank in another country. For most PVC building material importers buying container-load quantities, this risk is lower than the payment and document frauds above-but it rises sharply for buyers financing bulk inventory stored at origin over extended periods.

V. The Container Arrived. The Cargo Inside Was Not Yours.

A last category sits between supplier fraud and document fraud: the shipment that arrives as scheduled, with valid documents, containing goods that do not match the order. This is not a scam in the criminal sense-the supplier produced and shipped something-but it is a commercial injury that the buyer discovers after the money has been paid and the container has been opened.

A Dutch importer ordered 0.55 g/cm³ PVC foam board for screen printing. The container arrived with boards that measured 0.48 g/cm³ on the buyer's density balance. The supplier's defence: the specification in the contract said "0.50–0.60 g/cm³," and 0.48 was close enough. The buyer's position: the sample was 0.55, the order confirmed 0.55, and the contract's range was a formatting error in the supplier's template that the buyer had not corrected. The supplier offered a discount on the next order. The buyer had no leverage because the goods had been paid for, shipped, and cleared, and the cost of returning a container to China exceeded the value of the goods inside it.

The protection lies upstream: third-party inspection during production or before loading, a contract that specifies tolerances with precision, and a payment structure that withholds a meaningful portion of the balance until the goods are verified at destination. Some importers negotiate a 5–10 percent retention payable after destination inspection, with the inspection criteria agreed in the contract. Suppliers do not always accept retention terms, and when they do, the unit price adjusts to reflect the delayed payment. The negotiation is a test of the relationship as much as the terms.

The companion article on supplier verification covers the pre-payment checks that prevent this situation from arising. The defence after the fact is thin, because once the container has been paid, shipped, and cleared, the buyer's negotiating position has largely expired.

VI. Seven Rules for Protecting a Payment in Transit

Every case in this article has a common feature: the fraud succeeded because the buyer relied on a single channel of verification. An email. A scanned document. A forwarder's word. The defence is always the same structure applied to a different threat: verify through an independent channel before the money moves, not after.

One - Never change bank details by email alone. Agree at the start of the relationship that any bank detail change must be confirmed by a phone call or video call to a previously verified number. An email requesting a change that cannot be confirmed by voice within thirty minutes is an email that should be treated as compromised until proven otherwise.

Two - Verify every bill of lading against the carrier's system. Enter the container number on the shipping line's tracking website. Confirm the vessel, the voyage, the origin port, and the destination port match the details on the B/L copy the supplier sent. A mismatch on any field is a reason to stop the payment.

Three - Check the freight forwarder's physical address. A virtual office that houses fifty companies is not a freight forwarder. A genuine forwarder has a physical office you can visit or have a local contact visit. If the address does not withstand a street-view search, the forwarder does not withstand due diligence.

Four - Use a letter of credit for high-value first orders. An L/C confirmed by a reputable bank removes the risk of non-performance from the supplier and places it on the bank. The cost is higher than T/T. The peace of mind is the product you are buying.

Five - Verify warehouse receipts through independent channels. If a transaction involves goods stored at origin, the warehouse receipt should be issued by an independent third-party warehouse operator, not by the supplier's own facility. An electronic receipt registered with a central depository is stronger than a paper document from an unknown warehouse.

Six - Withhold a retention where possible. Negotiate a 5–10 percent retention payable after destination inspection, with the criteria agreed in the contract. Even if the supplier does not accept it, the negotiation reveals how the supplier handles a request that puts their money at risk.

Seven - Route all communication through company email domains. Free email services are trivially spoofed and impossible to verify. A supplier who conducts business through a free email address is a supplier whose communications cannot be authenticated. A company domain costs a few dollars a year. A supplier who will not pay for one is a supplier who will not pay for anything that does not directly generate revenue.

The two articles in this series-supplier verification and payment protection-cover the fraud landscape from the first contact to the final delivery. The payment terms guide and the Incoterms guide provide the legal framework that the fraudster exploits when the buyer does not understand it. For a quotation from a supplier whose factory, certificates, bank account, and forwarder can all be independently verified, contact our sales team.

Frequently Asked Questions

Frequently Asked Questions About Payment and Document Fraud
 

Common questions about protecting payments, verifying documents, and securing the transaction after the order is placed.

Q1: How do I know if my supplier's email has been compromised?

You usually cannot-at least not before the fraud attempt. The fraudster reads passively and only acts when a payment is due. The defence is procedural, not detective: agree from the first communication that any payment instruction, and especially any bank detail change, will be confirmed by a second channel. A phone call to a previously verified number. A video call. A message on a platform established before the transaction. If a payment instruction arrives and the second channel cannot confirm it, treat the instruction as fraudulent regardless of how authentic the email looks.

Q2: Can I recover money sent to a fraudulent account?

Recovery depends on speed. If the fraud is discovered within 24 to 48 hours and the receiving bank is in a jurisdiction with functioning anti-fraud procedures, a recall request through the sending bank has a realistic chance of freezing the funds before they are withdrawn or transferred. After 48 hours, the probability drops sharply. The best-case scenario is partial recovery after months of legal process. The realistic scenario is total loss. This is why prevention is the entire strategy-recovery is not a plan, it is a lottery.

Q3: What is the safest way to receive the original bill of lading?

Under a letter of credit, the original B/L is presented through the banking system, and the bank verifies it before releasing payment. Under T/T, the supplier couriers the original to the buyer after the balance is paid. The risk under T/T is that the supplier delays or withholds the original after payment. Using a letter of credit for the first transaction eliminates this risk. For subsequent transactions under T/T, using a telex release after full payment is faster than couriering originals, but it transfers title electronically before the buyer holds a physical document. The trade-off between speed and control is a judgment call based on the supplier relationship.

Q4: How do I verify a freight forwarder I have never used before?

Four checks. Confirm the forwarder has a physical office-search the address on a map and look for a real building, not a virtual office suite. Check their business licence with the relevant authority in their country of registration. Ask for three references from importers who have used them for multiple shipments-and call the references, do not just read them. Confirm they are a member of a recognised forwarder association, such as FIATA or a national equivalent. A forwarder who passes all four checks is not guaranteed to be honest, but a forwarder who cannot pass them is not worth the risk.

Q5: Should I use different forwarders for different shipments to spread the risk?

Spreading risk across multiple forwarders makes sense for large import programmes where a single forwarder failure would disrupt the entire supply chain. For small and medium importers running a few containers a year, the priority should be finding one forwarder who is thoroughly verified and building a relationship that improves service over time. A forwarder who knows your product, your ports, and your documentation preferences delivers more value than two forwarders who each know half of your business. The shipping and packaging guide covers the logistics side of forwarder coordination.

Trade With a Supplier Whose Documents You Can Verify

YUPSENI ships with carrier-verifiable bills of lading, company-domain email, and a bank account that matches the business licence. Every document your broker needs, confirmed through channels you control.

Request a Verified Quotation
YT

YUPSENI Team

23 years in PVC building material manufacturing and supply chain. We help importers protect their payments with the same discipline we apply to our production-verify, then trust. More about YUPSENI

© 2026 YUPSENI. All rights reserved. The cases in this article are based on real fraud patterns reported across the industry. All company names, buyer identities, and transaction details have been anonymised. This article is for informational purposes and does not constitute legal or financial advice.

You Might Also Like