How do you avoid payment fraud when working with overseas clients?

Why are exporters and freelancers targeted?

Because the work happens at a distance. You may never meet the client, the first contact is often an email or a marketplace message, and payment comes from another country through banks you do not know. That leaves room for a fraudster to pose as a client, or to slip between you and a real one. The losses are large: the FBI’s Internet Crime Complaint Center reported in September 2024 that business email compromise alone had produced more than US$55 billion in exposed losses worldwide between October 2013 and December 2023.

How does an overpayment scam work?

A new client sends more than the invoice — by cheque, card or transfer — and then asks you to send the difference back, often to a different person or by a different method. The first payment later turns out to be fake or is reversed, and the money you sent back is gone. The US Federal Trade Commission’s advice on fake check scams puts it plainly: “Even if you see the funds in your account, that doesn’t mean it’s a good check”, and “It can take weeks for a bank to figure out that the check is a fake.” Card payments can be disputed long after they appear to have succeeded; see chargebacks and disputes.

• Do not accept a payment for more than the agreed amount.
• If it happens, refund nothing until your bank confirms the original payment is final.
• Refund only to the account it came from, by the same route — never to a “partner”, by gift card or by crypto.

How do you spot a fake payment screenshot?

A screenshot of a banking app or a “payment sent” email is easy to fake. A genuine international transfer also takes time to reach you, so “I have paid, please send the files” on the same day is a warning sign in itself. The rule is simple: the only proof of payment is the credit in your own account, or the remittance advice your bank or provider gives you. If a client sends a reference number, you can ask your bank to trace it; until the money is there, it has not arrived.

What is business email compromise, and how does it hit exporters?

Business email compromise (BEC) — called mandate or payment diversion fraud in the UK — is when a criminal takes over or imitates an email account and asks for a payment to be sent somewhere new. For an exporter it works two ways:

• Your email is used against your client. A fraudster who has read your mail sends the client an invoice, or a note, saying your bank details have changed. The client pays the fraudster and believes it has paid you.
• Your client’s email is used against you. A supplier or a “client” asks you to pay a refund or a fee to new details.

The UK’s national fraud reporting service — Action Fraud, replaced by Report Fraud from 4 December 2025 — advises checking any email or call about a change of bank details through an independent route — a phone call on a known number, or in person — and considering a small test payment before a large one. The FBI’s advice is the same: verify changes to account information through a separate channel, and check that the sender’s address and links match the real business, watching for misspelled domains.

Other red flags from new “clients”

• They want to start immediately and pay more than you asked, without negotiating scope.
• They will only communicate through a messaging app and refuse a video call.
• The email domain does not match the company website, or the company has no trace beyond a new site.
• They ask you to buy software, equipment or “onboarding” from a vendor they choose, to be reimbursed later.
• They ask you to receive money from a third party and pass part of it on. That makes your account a mule account, which banks are required to look for — see AML red flags.
• They insist on paying through an app or platform you have never heard of.

What should you do if you have been defrauded?

1. Call your bank at once. Ask it to stop or recall the payment and to contact the receiving bank. Speed matters more than anything else.
2. In India, call 1930, the national cyber fraud helpline run with the Indian Cybercrime Coordination Centre, then complete the complaint on cybercrime.gov.in using the acknowledgement number you receive.
3. If the fraud came from the US or UK, you can also report it to the FBI’s IC3 or to the UK’s Report Fraud service (formerly Action Fraud); reports help them trace the accounts used.
4. Secure your accounts. Change passwords, turn on two-factor authentication and check for email forwarding rules you did not create.
5. Warn your clients if your email was used, and confirm your real bank details by phone.
6. Keep everything: emails with full headers, screenshots, transaction references.

How can your payment set-up help?

The fewer places your clients can pay, the harder you are to impersonate. Give each client one set of bank details, in writing, at the start, and never change them without a call. A receiving account per client helps here too: each client pays its own account in your name, so a payment either arrives in that account — identified — or it has not arrived at all.