Verifying a Chinese Foundry's Bank Account Before You Pay

Every other page in this series is about whether a casting is what it claims to be. This one is about whether the company you are paying is the company you think you are paying, which is a different and faster way to lose money.

The pattern is consistent across the industry and it rarely involves a fake factory. The supplier is real, the parts are real, and the fraud is committed by someone who has access to the email thread — either an attacker who compromised an account, or, less often, an insider. The order proceeds normally and the loss happens at the payment step.

The three-name rule

Before the first payment and again after any change, three names have to agree:

In Chinese banking the beneficiary name must be the legal entity name, character for character. There is no “trading as” shortcut. So a mismatch is not a paperwork detail to sort out later — it means the money is going somewhere other than the entity that owes you a shipment.

The legitimate exceptions are narrow and worth knowing: some groups invoice through a designated trading subsidiary, which is fine if the relationship is disclosed in the contract and the subsidiary is named in it. What is not fine is a factory collecting into a personal account, or an entity name that appears nowhere in your documents.

The mid-order change, which is where the money goes

Almost all successful fraud in this category happens after the relationship is established. The sequence is predictable:

1. You have paid two or three invoices to the same account without incident.
2. A message arrives in the existing thread, in the supplier’s style, often replying to a real message so the quoting is correct.
3. It explains a change: the company has restructured, the bank has upgraded its system, an audit requires a new account, or the old account is frozen.
4. New beneficiary details are attached, sometimes with a stamped letter.
5. The timing is deliberate — usually just before a large balance payment, or while the shipper is waiting for a telex release.

Every element is designed to make verification feel rude. The professional response is to be rude for a day.

How to verify, in the right order

1. Compare the account name to the licence, character by character

Chinese company names are long and differ by suffixes that look similar. Check the full registered name, not the short form used in emails. If the beneficiary reads as a shortened or translated version of the name, ask for the account opening certificate (开户证明) from the bank, which shows the exact registered name held on the account.

2. Call a number you already have

Not the number in the suspicious email, and not the number on the new letterhead. Use a number from an earlier invoice, a contract, a document you received weeks ago, or the registered contact on the business licence. Ask to speak to the finance contact by name and confirm the account change.

If the supplier cannot be reached on any previously known number, that is itself information.

3. Check the domain, not just the display name

Spoofing a display name is trivial. Look at the actual sending domain. Attackers register lookalikes that differ by one character, a hyphen, or a different top-level domain. On a phone the address is often hidden entirely, which is why the instruction to “check the sender” fails in practice. Open the message on a desktop and read the raw address.

4. Ask for a bank confirmation through a second channel

Request that the supplier’s bank issue a confirmation of account details, or that the supplier send the stamped letter through a channel other than email — a portal, a courier, or a messaging app you already use with that contact. The point is not the document; it is that the request crosses a channel an email attacker does not control.

5. Test with a small payment

On a first order, send the deposit to the verified account and confirm receipt with the finance contact by phone before sending the balance. A fraudulent account will often fail to acknowledge because there is nobody on the other side who knows about your order.

Red flags worth stopping for

• Beneficiary name differs from the contracting entity, with an explanation but no documentation.
• A personal or individual account as the beneficiary for a company order.
• A bank in a different city or province from the factory, with no explanation.
• Urgency — the shipment is held, the vessel is closing, the account will be frozen tomorrow.
• A change of contact person arriving with the change of bank details.
• Reply-to address different from the From address, or a display name that hides a lookalike domain.
• A new letterhead for the same company, appearing at the same time as the account change.

One of these is worth a phone call. Three together, on a payment of any size, mean stop until the account is confirmed independently.

What a supplier should be willing to provide

A legitimate Chinese foundry will provide all of the following without irritation, because these requests are routine with European and North American customers:

• Business licence, with the registered name clearly visible.
• Bank account opening certificate showing the account name and number.
• A stamped letter on letterhead confirming the account, signed by a named officer.
• The name of the finance contact, and a direct line that answers.
• Written notice of any account change, on letterhead, before the change takes effect.

Irritation at these requests is not proof of fraud, but it is unusual in an established exporter. A supplier who has been paid by international transfer for ten years has been asked this before.

If the money has already gone

Speed dominates everything. In order:

1. Call your bank immediately and request a recall, quoting the SWIFT reference and the payment date. Same-day action gives the best chance.
2. Notify the receiving bank through your own bank, requesting that the funds be held.
3. Contact the supplier by phone on a known number to establish whether their account was compromised, which is often the case and determines your next step.
4. Preserve the emails with full headers, which carry the sending server information needed for any investigation.
5. Report to the police in your jurisdiction. Cross-border recovery usually requires a formal report.

Recovery rates drop steeply after the first 24 to 48 hours, and once funds are withdrawn from the receiving account the practical outcome is usually a loss. Which is the entire argument for a two-day verification habit that costs nothing.

The habit, in one paragraph

Before the first payment, get the business licence and the bank account opening certificate, and check that the account name matches the licence and the contract. If anything about the account ever changes, do not pay until you have spoken to a named finance contact on a number you held before the change. Keep the account details in your own records rather than relying on the last email. That is the whole control, and it prevents the most expensive failure in this entire verification series.