Wire Transfer Checks for China Suppliers

Before the clock starts: freeze the baseline

Create an approved payment packet with a version or timestamp. It should name the Chinese supplier, contract party, invoice issuer, beneficiary, account number, bank, SWIFT or BIC, bank country, currency, amount, invoice or purchase-order reference, and approvers. The beneficiary review should already explain any third-party payee.

Once the packet enters release, do not overwrite it with a fresh email attachment. A new account, beneficiary, bank country, or phone number starts a separate change review. The IC3 describes business email compromise as a transfer-fraud method that can operate through a genuinely compromised business account, not only an obviously fake message. Read the IC3 guidance.

The ten-minute release protocol

T-10: identify the payment and the source record

Write down the packet version, invoice number, payment stage, amount, currency, and person requesting release. Confirm that the payment belongs to this order and this milestone. If finance cannot locate the approved source record, the countdown does not begin.

T-8: compare the beneficiary line by line

Compare the frozen record with the payment instruction and bank screen. Read the beneficiary name, full account or IBAN where applicable, bank name, SWIFT or BIC, bank country, amount, currency, and payment reference. Compare characters rather than relying on a familiar-looking name. The instruction must also say whether bank fees follow the contract or purchase order.

This is a three-way comparison: approved baseline, supplier document, and bank entry. A registry result can identify a company, but it does not independently prove ownership of a bank account.

T-6: make the independent callback

Always use a callback for a new or changed beneficiary and whenever the organization's payment policy requires it. Call a number from the previously approved vendor record, an earlier verified contract, or another independently established source. Do not use the number, meeting link, or messaging account introduced in the change request.

Ask the known contact to state the beneficiary, account ending, bank, currency, and invoice rather than simply agreeing with details read to them. Record the contact's name, number source, time, and result. IC3 recommends a secondary channel for account-information changes. Hong Kong Police guidance likewise advises confirmation outside the email and a dual-verification payment process.

T-4: separate request, review, and release

The commercial owner confirms why the payment is due. A reviewer compares the packet and resolves exceptions. The releaser enters or authorizes the wire. One person may prepare data, but a second responsible person should see the final beneficiary and amount before release. For a small team, that reviewer can be the owner or an external finance controller; the control is independent attention, not a particular job title.

The reviewer should not approve a change they requested, edit the bank details while reviewing them, or rely on “management already knows” without a recorded decision.

T-2: read the bank entry back to the frozen record

After data entry, stop typing and perform a clean read-back. Check beneficiary, account, bank code, country, amount, currency, fee option, and payment reference from the bank screen against the frozen packet. Do not compare the bank screen only with the latest email. If the bank presents a beneficiary warning or truncates a material field, pause and ask the bank how to resolve it.

T-0: release and preserve evidence

Record who released the wire, the bank confirmation or transaction reference, time, amount, and beneficiary. Save the approved packet, callback note, final bank-entry evidence, and any exception approval together. Do not email a full unmasked bank record more widely than the company's security policy permits.

Stop conditions that restart the process

• The account, beneficiary, bank, country, currency, or payment channel changed after approval.
• The callback reaches only a new number, the person refuses to state the details, or the answer conflicts with the packet.
• The bank entry names a person or unrelated company where the approved record names the supplier.
• The amount, invoice, deposit stage, or contract reference does not reconcile.
• The requester asks finance to bypass the reviewer, split the wire, conceal the payment, or release while an exception remains open.
• A message arrives from a look-alike domain or the normal channel changes at the payment moment.

These conditions do not prove fraud. They mean the approved payment has changed. The Chinese-language anti-fraud handbook published by the National Anti-Fraud Center and government partners describes attackers monitoring trade correspondence and substituting a collection account at the right moment. See the official handbook. A Ministry of Commerce notice describes the same failure pattern involving similar email addresses, changed bank instructions, and no telephone confirmation. Read the trade-risk notice.

The one-page release record

Keep the record factual enough that another reviewer can reconstruct the decision:

1. Payment: supplier, order, invoice, stage, amount, currency, and due date.
2. Baseline: beneficiary-record version and date last approved.
3. Comparison: fields matched and any masked fields the bank would not display.
4. Callback: trigger, known contact, source of number, time, and details stated.
5. Roles: requester, reviewer, preparer, and releaser.
6. Exceptions: exact difference, supporting evidence, decision owner, and expiry.
7. Release: bank reference, timestamp, and storage location of the evidence packet.

“Confirmed by supplier” is not a useful note. “Called the number from the signed 2025 contract; accounts manager stated the beneficiary ending 4821 and invoice CV-104; reviewer initials and time recorded” is reviewable later.

If concern appears after release

Contact the sending bank immediately through its official number and report the suspected fraudulent transfer. Ask what recall, reversal, hold-harmless, indemnity, or beneficiary-bank contact steps are available; outcomes vary and recovery is not guaranteed. IC3 and the UK's NCSC business-payment guidance both emphasize prompt bank contact. The FTC likewise advises a bank-wire sender to report the transfer and ask whether reversal is possible. Review the FTC incident steps.

At the same time, alert the organization's security or IT owner, preserve emails and headers, stop related payments, and follow local reporting and legal procedures. Do not wait for the questioned email sender to reply. The changed-bank-details response covers the fuller incident sequence.

What the final check does not replace

This protocol cannot establish supplier legitimacy, product conformity, shipment readiness, contract enforceability, or financial health. Resolve those questions before the payment window. Use the company-before-payment gate for identity and current company status, the supplier red-flag guide for unresolved warning signals, and the deposit review for first-payment commercial conditions.

If the current Chinese legal name or USCC is still unknown, identify the company before finance starts the countdown. A ten-minute release check protects an approved payment from last-minute substitution; it cannot turn an unverified transaction into an approved one.

This article describes an internal payment-control model. It is not banking, cyber-incident, legal, accounting, sanctions, anti-money-laundering, or recovery advice.