B2B trade fraud: warning signs and verification steps

Scheme 1: changed bank details

This is the most common and most expensive scheme. The fraudster compromises the supplier's mailbox or registers a lookalike domain (one swapped letter is enough) and, in the middle of a live deal, announces that "due to an audit" or "a change of bank" payment must go to a new account. Europol describes this as invoice fraud: the criminal poses as the supplier, and the victim usually finds out only when the real supplier chases the unpaid invoice.

How to protect yourself:

• confirm any change of account by phone on a number you already know from past dealings or from the official website, never on a number in the email asking for the change;
• require two people to approve changes to supplier bank details in your payment system;
• compare the sender's domain character by character;
• treat time pressure ("pay today or we lose the vessel") as a warning sign;
• when paying Polish companies more than PLN 15,000, check that the account is on the Polish VAT white list on the day of payment.

A related scheme is CEO fraud: someone poses as your own senior management and orders an urgent transfer. The defence is the same: verify through a separate channel.

Scheme 2: the price that is too good

An offer well below market, usually with a demand for full prepayment. Common in liquid commodities: sugar, edible oils, fuels, metals, alcohol, fertilisers. It often comes with requests for upfront fees "for documents", "an export licence" or "vessel booking".

What to check:

• where the seller gets the goods, whether it is the producer and whether its capacity matches the volumes offered;
• whether the price has a logical explanation (end of season, surplus, a different specification);
• whether the seller accepts any buyer-protective payment method, such as D/P collection or a letter of credit. Refusing anything except prepayment on a large deal is a serious signal.

Scheme 3: fake companies and impersonation

Fraudsters register domains resembling known producers and copy their websites, plant photos and certificates. Sometimes they trade under the name of a real, registered company they have nothing to do with.

Verification:

• check the company in the official register of its home country and compare the registration number, address and representatives with the documents;
• contact the company using details from the register or its official website, not the email you received;
• check how old the domain is and whether the email address uses the same domain as the website;
• ask for a video call from the plant or an independent inspection.

For Philippine exporters, the flip side matters too: EU buyers are cautious, so make verification easy. Share your SEC or DTI registration details, a company email domain and verifiable references upfront.

The full process is in our guide to verifying a foreign supplier.

Scheme 4: forged documents

Forged bills of lading, certificates of analysis, quality certificates, certificates of origin or insurance policies are used to collect payment for goods that were never shipped or differ from the order.

How to verify:

• bill of lading: check the B/L number and container number in the carrier's tracking system on its official website; compare the vessel, port and dates;
• certificates: contact the certification body or laboratory via its official website and confirm the document number;
• certificate of origin: confirm with the issuer, for example the chamber of commerce;
• insurance: confirm with the insurer, not with the seller.

Warning signs in documents: mixed fonts, missing reference numbers, inconsistent dates, vessel names that did not sail the route, blank signature fields.

Scheme 5: the buyer who never pays

Sellers are targets too. A new buyer orders a large lot on deferred terms, asks for fast shipment and disappears. Another variant: the "buyer" sends a fake payment confirmation and pushes for release of the goods.

Seller protection:

• first deals on prepayment, letter of credit or D/P collection;
• release goods only once funds are actually credited, not on a PDF "SWIFT confirmation";
• credit insurance when selling on open account.

Warning signs at a glance

If you have been defrauded

1. Contact your bank immediately and ask it to try to stop or recall the transfer. Time is critical.
2. Report it to the police. Europol advises reporting attempts even when they failed.
3. Report compromised mailboxes or spoofed emails to your national CERT or cybercrime unit.
4. Preserve the correspondence, email headers and documents.
5. Tell the genuine counterparty if someone impersonated it.

How Hiram reduces the risk

On Hiram, companies with an EU VAT number are checked in VIES, and Polish companies also against the Polish VAT white list and KRS; each profile shows the verification level actually reached. Companies outside the EU are not checked in registries automatically. All counterparties are screened against EU, UN, UK and US sanctions lists. Hiram does not hold money or guarantee payment: the buyer pays the seller directly, so the bank-detail checks above still apply.

To see each counterparty's verification level before you start talking, create a Hiram account.

Sources

• Europol, Invoice fraud (awareness material): https://www.europol.europa.eu/cms/sites/default/files/documents/6_invoice_fraud.pdf (opens in a new tab)
• Europol, Focus on CEO Fraud: https://www.europol.europa.eu/media-press/newsroom/news/focus-ceo-fraud (opens in a new tab)
• Biznes.gov.pl, Polish VAT white list (Polish): https://www.biznes.gov.pl/pl/portal/00226 (opens in a new tab)
• ICC, URC 522 - Uniform Rules for Collections: https://2go.iccwbo.org/urc-522-uniform-rules-for-collections-config-1+book_version-Book/ (opens in a new tab)