Supplier Payment Fraud: How Buyers Get Scammed — and How Not To

By YZR Sweaters · 2026-10

In a decade of Dongguan knitwear production we've watched fraud evolve from clumsy fake-supplier websites to something much more surgical: criminals who know your order number, your styles, your ship date — because they're reading your supplier's inbox. Buyers who lose serious money almost always did everything else right. Here's how it actually happens and the habits that stop it.

Why knitwear orders are a good target

Clothing sourcing from China has a fraud-friendly structure, and it's worth being blunt about why:

• Long payment cycles with large final balances. A typical structure — deposit, mid-payment, balance before shipment, per our payment terms guide — means weeks of email between first contact and the biggest transfer. Weeks of thread for a criminal to sit inside.
• High-value single transfers. A 30% deposit on 3,000 sweaters can be a five-figure sum moving in one wire, to a foreign account, across currencies.
• Everyone expects urgency. "Factory needs the balance today to catch the vessel" is normal in this industry, so a manufactured deadline doesn't feel suspicious.
• Email is the system of record. Specs, POs, invoices, bank details — all in the same thread, often on free mail services with weak security on one side or both.

The three ways it actually happens

1. Email account compromise — the expensive one

Somebody gets into the supplier's (or the buyer's) mailbox and quietly reads for weeks. Nothing changes. Then, days before a major payment, a message arrives from the real address: new account at a different bank, same tone, real order details, maybe a real attached invoice with one digit altered. Some fraudsters create lookalike domains — yzrsweaters-c0m.com, or the supplier's name with an extra hyphen — and reply-all into an existing thread so the swap is easy to miss in a long conversation.

The signature detail: it works because nothing else is wrong. The English is right, the order details are right, the timing is plausible. The only anomaly is the account.

2. The fake supplier

A polished website, a responsive "sales manager", attractive prices, professional sample photos borrowed from somewhere. They take a deposit — sometimes they even knit a sample — then quality slides, deadlines slide, and eventually the trail dissolves. Less common than it used to be, but it still catches buyers shopping purely on price. The afternoon of checks in our remote supplier verification guide — registry cross-check, licence match, live video of the knitting floor — defeats almost all of it.

3. The slow drift

Not always criminal at the start: a personal account request "to save fees", a different company name "our export office handles invoices", a change of bank "our old account has issues". Each request is individually arguable; together they move money out of the structure that your contract, your licence check and your recourse all depend on. Some are fraud, some are tax manoeuvring — and from where you sit, the risk profile is identical.

Controls that actually stop it

• Lock the account at contract time. Bank name, account number and account holder in the sales contract — matched to the business licence name, as covered in our supplier vetting checklist. Any payment to any other account is a contract breach, and the supplier knows you treat it that way.
• The two-channel rule. Any bank detail change — indeed any request to move money — is confirmed by voice on a phone number you had before the request. Not the number in the suspicious email. Not a WhatsApp account that appeared last week. This single habit defeats email compromise almost completely, and it's why our bank details are confirmed with buyers at order time and never change mid-order.
• Company accounts only. The account holder's name should match the contracted legal entity (or its documented export arm). A personal account, or a third company's name, is a structural red flag regardless of the story around it.
• Re-verify at payment time, cheaply. Before each large transfer, compare the account you're paying against the contract — thirty seconds of looking, before the money leaves, when everything is still recoverable.
• Structure the risk away. Tie balances to a passed pre-shipment inspection, and split large programs into staged shipments so no single transfer is catastrophic. The contract essentials piece covers the clauses that make recovery possible.
• Hardwire email hygiene. Confirm the supplier's domain character-by-character once, store it, and flag lookalikes. This matters on both sides — buyer mailboxes get compromised too, and from the criminal's seat they're equally interesting.

If it happens anyway

Speed is everything, and the first day is worth the next month:

• Recall the wire immediately — call your bank's fraud line and request a wire recall while the funds may still be in the intermediary or receiving bank. Success drops by the hour; after 72 hours the odds are poor.
• Freeze the thread. Get the supplier onto a known-good channel (phone, the WhatsApp number from their verified profile) and have their IT secure the mailbox and check for forwarding rules — the quiet forwarding rule is how compromise persists.
• Report it formally — local police in your country, and encourage the supplier to report in China. Recovery via the banking system sometimes works when both reports exist. Document everything for the insurers, too.

We keep this boring at YZR Sweaters: one company account, details written into every contract, confirmed at order time on a call, and unchanged through the order. If anyone ever emails you new YZR payment details, don't pay it — call daniel@yzrsweaters.com's known number or WhatsApp +86 137 2449 4230 first, and we'll both be happier you did.

Frequently asked questions