Cross-border Trade
Bank-detail changes need an independent check
A practical payment-change control for independent freight forwarders: verify the obligation, confirm new banking instructions independently and record who authorised the release.
A changed bank account is a separate decision
A legitimate freight invoice and a legitimate payment destination are two different things. A forwarder may recognise the overseas agent, shipment reference and amount, yet still receive fraudulent instructions about where to send the money. The FBI explains that criminals can impersonate familiar senders or obtain access to genuine billing conversations. It recommends independently checking payment requests and changes to account numbers or payment procedures. [1]
For an independent forwarder, our recommendation is straightforward: treat every proposed change of payment destination as a controlled supplier-record change, not an ordinary reply in a shipment email chain. An approaching cut-off should trigger an escalation to the authorised manager, not an exception that lets the same person accept new banking details and release the payment without independent checking.
Check the invoice before checking the new account
The US Federal Trade Commission warns that businesses receive invoices for products or services they never ordered, sometimes carrying a past-due message. Its guidance calls for close invoice checking and clear procedures for approving purchases and vendor invoices. [2] This addresses a different question from whether the beneficiary details are genuine: is there a valid obligation to pay at all?
We recommend matching the invoice to the supplier, agreed service, shipment or other business reference, currency and approval record before considering a bank-detail amendment. Keep disputed charges separate from the verification process. A valid invoice should not make an unverified destination acceptable; equally, a verified supplier account should not make an unsupported invoice payable. Document which question remains unresolved so operations and accounts do not mistake a partial check for full approval.
Verify outside the request itself
The Australian Signals Directorate's account-compromise guidance recommends approval processes for payment-detail changes and verification by speaking with the sender on a verified phone number, rather than a number supplied in the email. [3] The FBI likewise advises finding contact information independently instead of relying on details in a suspicious request. [1] These are operational safeguards, not a reason to assume that every change request is fraudulent.
For a forwarding desk, we recommend calling a supplier contact through a previously verified record or another independently established route. Ask them to confirm the requested change, beneficiary and relevant currency. Do not accept a new contact number and new bank account from the same message as two independent pieces of evidence. If the usual contact is unavailable across time zones, hold the change and escalate through the documented approval route; do not turn an email reply into substitute verification.
Keep a small, usable change record
Our proposed record is deliberately modest: supplier identifier, request received time, requested effective date, affected currency or account, verifier, independently established contact route, verification result, approver and master-record update time. Store banking information only in the appropriately restricted supplier system. The shipment record can reference the approved change without distributing account details to every colleague and overseas partner copied into a conversation.
Separate the roles where staffing permits. One person records and verifies the request; another authorised person approves the master-data change and payment release. For a very small firm, name an owner or director as the escalation point and establish a backup before leave or travel. These are our recommended controls, not a claim that a particular staffing pattern is legally required or sufficient to prevent every fraud.
Test the control before the next urgent request
This week, run a short internal exercise using fictional details, not real customer or supplier banking data. Give the team an otherwise plausible invoice accompanied by new beneficiary instructions and a departure deadline. Ask them to show where the payment is held, how they obtain a trusted contact number, who can approve the change and how the next shift knows whether the check has finished.
Record the result against observable checks: the change was held pending verification; the contact route did not come from the request; an authorised approver could see the evidence; and no payment used the proposed destination before approval. Fix one gap at a time. The useful measure is whether the team follows a repeatable decision path under pressure, rather than whether everyone can recite the warning signs of a suspicious email.
Have an immediate response route
If a suspected fraudulent transfer has already occurred, the FBI advises contacting the financial institution immediately and asking it to contact the receiving institution, as well as reporting business email compromise through IC3. [1] Build that contact route into the operating procedure before an incident. Do not wait for the next routine reconciliation to decide who is responsible for calling the bank.
Email security still matters: ASD recommends multi-factor authentication for business accounts where possible. [3] But account protection and payment approval solve different parts of the problem. The practical objective for a forwarder is a clear stop, an independent check and an accountable release decision. This article is AI-assisted operational guidance, not legal, banking, customs or security advice; use appropriately qualified advisers for binding decisions and incident response.
Sources
- Business Email Compromise — Federal Bureau of Investigation
- Run a small business? Pay your bills, not scammers — US Federal Trade Commission
- Learn about account compromise — Australian Signals Directorate
General operational guidance. Apply the approval and regulatory requirements relevant to your business and shipment.