My supplier sent new bank details. What should I check?

You have been paying the same supplier for months, or you are about to pay a deposit. An email arrives from the usual contact: the company has changed banks, or the account is “under audit”, and this payment should go to a new account. A new invoice is attached, with a seal and the right logo.

Treat the change as unconfirmed until you have verified it through a channel that did not come from the message itself. Do not reply to the email to check it, and do not call a number printed in it. Hold the payment until the supplier confirms the new details through contact details you already had, and until the new beneficiary makes sense for this order. If you have already paid, contact your bank immediately and ask it to recall the transfer.

Why this request needs a pause

A changed-account request is the standard method of business email compromise. The fraudster gains access to a real mailbox, either the supplier’s or yours, or registers a lookalike domain, reads the correspondence, and sends new payment instructions at the moment a payment is due. The FBI’s Internet Crime Complaint Center describes this as a scam that targets legitimate transfer requests, carried out by compromising business email accounts through social engineering or intrusion. Its 2024 announcement, based on 2023 data, notes that banks in the United Kingdom and Hong Kong often acted as an intermediary stop for the funds, followed by China, Mexico and the UAE. IC3.

Because the message can come from the supplier’s real address and quote your real order, nothing in the message itself can confirm it. A seal, a letterhead, a PDF invoice and a familiar writing style can all be copied from earlier emails.

Suppliers do sometimes change banks or start collecting through a different entity. The pause is not an accusation; it is the check that tells a genuine change from a fraudulent one.

Confirm the change through a separate channel

The IC3 advises using secondary channels or two-factor authentication to verify requests to change account information. IC3. In practice:

• Call a number you already had. Use the phone number from your contract, an earlier invoice you received before the change, or a call you have made before. Do not use a number from the change request or from the signature of the same email thread.
• Speak to someone you know. Ask your usual contact, and if possible a second person such as the sales manager or the finance department, to read out the new account number and beneficiary name. Read nothing out to them first.
• Use a different medium you set up earlier. A WeChat or WhatsApp conversation that predates the request is a separate channel; a new chat account the email asks you to add is not.
• Ask why the account changed. A genuine change has an ordinary answer: a new bank relationship, a new collecting entity in the group, a change of company. Note the answer; you will compare it with the documents.

If the supplier says it never sent the request, both mailboxes may be compromised. Tell the supplier, stop using email for payment instructions on this order, and keep the message for your bank.

Check that the new beneficiary makes sense

Confirmation by phone tells you the supplier made the request. It does not tell you that the new beneficiary is a party you should pay. Compare the new details with what you know about the order:

• Is the beneficiary still the seller? If the account name is the same registered company as before and as on the contract, the change is a bank change. If the name is different, it is a change of payee, which needs more than a phone call.
• Is it a variant of the same name? A Chinese company’s account may appear under an English rendering of its Chinese name. Check whether the new name is a spelling or translation variant before treating it as a different party. The guide on beneficiary names that do not match the supplier covers this.
• Is it a Hong Kong company? A Hong Kong collecting company can be legitimate, but a switch to one in the middle of a relationship needs the same evidence as any new payee. See a Hong Kong company receiving payment.
• Is it an individual? A request to pay a person rather than a company, at short notice, should hold the payment until it is explained in writing by the seller and you are satisfied with the explanation.
• Has the bank’s country changed? A beneficiary bank in a country with no connection to the supplier or the order is a reason to stop and ask.

Ask for the new payment details on an updated proforma invoice or contract amendment from the seller, naming the beneficiary and stating that payment to it settles your obligation for this order. Confirm that document through the same separate channel.

Check the company behind the request

If the change comes with a new company name, or you never confirmed the original one, check the registered record of the mainland company. You can look it up in English by its English or Chinese name or its unified social credit code (USCC). Finding it is free; the full English report is paid. A registry record confirms that a company exists and what is on file for it. It does not confirm a bank account, and it does not tell you who sent the email.

The steps for checking the company itself, its documents and its authority to sign are in the guide to verifying a Chinese supplier.

Ask your bank before you send

A registry search does not verify a bank account. Before sending the payment, ask your bank what checks it can run on the beneficiary of an international transfer, and what it can do if you report fraud after sending. Some banks can check the beneficiary name against the receiving account for some kinds of payment; ask whether that applies to this transfer. If it does not, the other checks in this guide carry the whole weight.

If you have already paid

Act the same day. The IC3 advises that if you discover a fraudulent transfer, time is of the essence: contact your financial institution immediately and request a recall of the funds, and file a complaint with the IC3 regardless of the amount lost. IC3. The IC3 is a United States service; if you are elsewhere, also report to the police or the fraud reporting service in your own country.

• Give your bank the date, amount, beneficiary account and the reference of the transfer.
• Keep the emails with their full headers, the invoices and any chat messages. Do not delete the thread.
• Tell the genuine supplier through a known channel. Its mailbox may be the one that was compromised, and other buyers may be receiving the same request.
• Change the passwords on your own email and check its forwarding rules, in case the compromise was on your side.

Recovery is not guaranteed and depends on how quickly the receiving bank is reached. The earlier the recall request, the better the chance.

What these checks establish

A change confirmed by phone with a known contact, a beneficiary that is the seller or a documented collecting party, and updated instructions from the seller together make the request much less likely to be fraud. They do not guarantee that the account is controlled by the supplier or that the goods will be delivered. Keep any unexplained point visible and decide whether it is worth the payment.

What this guide does not cover

This guide covers checking a request to change payment details before paying a supplier in China or Hong Kong. It does not cover email security in depth, recovery proceedings, chargebacks or insurance, or the law of any particular country, and it is not legal advice.

If a change of payee has left you with a contract, an invoice and bank details that no longer agree, and you want the mainland company checked against its registry record and the new beneficiary compared to it, you can start a verification with the documents you have.