Cyber ​​Fraud in International Trade – Precautions and Remedies: Clyde & Co


The continuous development of cyber threats has led to the penetration of cybercrime into various sectors and markets. Clyde & Co’s Shanghai office recently received several instructions regarding cyber-fraud incidents related to international trade from clients requesting assistance in recovering funds misappropriated and wrongfully paid into third-party bank accounts opened in mainland China. . This article reviews the main methods used by fraudsters to take advantage of these bank accounts and offers advice on the precautionary measures that can be used to minimize the risks as well as the effective remedies available to recover these funds once. a fraud has been perpetrated.

Cyber ​​fraud in international trade

By comparing the various cyber fraud cases we have come across, we have been able to compile a summary of the main steps frequently followed by criminals to defraud their target victim. They are the following:

STEP 1 – Fraudsters hack messaging systems or other instant messaging services (such as WhatsApp and WeChat) used by seller and buyer to communicate and steal relevant business information.

STEP 2 – They use newly created email addresses or instant messaging accounts that look very similar to the real ones used by the business parties, and communicate by impersonating the real parties, blocking and obtaining business details and deceptively becoming the interface between the parties.

STEP 3 – Once the transaction is at the shipping and payment stage, fraudsters falsely claim, impersonating the seller, that they need to change the recipient’s bank account for some reason (e.g. regulation tax) which may seem quite reasonable, and they therefore require the buyer to deposit the funds into a third party bank account designated by him, in this case an account opened in a local bank in mainland China. (the “Beneficiary Bank”).

STEP 4 – The criminal actors disappear after transferring the funds from the third party bank account to a different bank account belonging to yet different parties. Although the funds are technically traceable, the move is intended as a type of money laundering exercise.


It is generally difficult to investigate cyber fraud cases, which occur in international trade, without cross-border cooperation, as the parties involved are often based in different countries or even regions of the world. In this context, it is quite difficult to verify the location of the fraud and the identity of the fraudsters. Also, since fraudsters usually transfer the funds immediately after receiving them, unless the victims freeze the funds or seize the bank account in time, recovery will usually be very difficult.

Precautionary measures

Given the difficulty and cost of implementing post-fraud solutions following a fraudulent event, as discussed below, it is advisable to take precautionary measures beforehand to minimize the risk of incurring such losses. For instance:

  1. Carefully check and verify the e-mail address or instant messaging account used by the seller during communications, in particular when receiving payment instructions. In practice, it may be difficult to detect, at first sight when receiving e-mails, the discrepancy with the e-mail address used by the fraudster, but it will be easier to spot the difference after clicking on the reply button. It is advisable to pay particular attention to the suffix of the e-mail address (the part that is to the right of the @ symbol), which would normally be very different from the real e-mail address.

  1. Pay attention to the seller’s address and contact details as displayed in the email signature or IM account. See if they are consistent with those you previously knew or provided in the public domain.

  1. Investigate with professional third parties the authenticity of the reasons given for changing the bank details, as well as the relationship between the seller and the holder of the new bank account.

  1. Re-confirmation, by video calls, of the identity of the seller and the authenticity of the payment instructions and/or the change of bank account.

  1. Implemented a comprehensive internal payment review process.

  1. Establish a robust security procedure and purchase insurance against exposure to cyber fraud.


In cyber fraud cases, payments are usually requested by wire transfer because this method is quick and leaves victims little time to respond or take action to suspend transactions. However, if victims do not take corrective action as soon as they become aware of the potential fraud, they will most likely miss the best opportunity to keep their funds and could face a difficult and costly recovery exercise as well as a potential exposure to further losses.

As soon as they suspect a criminal act, victims of such fraud are urged to take urgent and effective measures to prevent the transfer of funds. The following steps may prove effective:

  1. Send a notice to the beneficiary bank suspending the release of funds

In practice, if the beneficiary uses a bank account opened in mainland China to receive a transfer from abroad, he will have to settle the currencies at the recipient’s bank before being able to control, dispose of or transfer the funds out of the account. . A victim may therefore choose to issue a notice of suspension of release of funds or a similar message to the recipient’s bank, either directly on their own or through the paying bank, explaining that the payment may involve cyber fraud. They should ask the beneficiary bank to prevent the beneficiary from settling the change (meaning the funds cannot be released to the beneficiary) or disposing of the affected funds, pending further investigation and/or a decision. judicial authorities.

To get the funds released as soon as possible, cyber fraudsters would normally have to falsify relevant business documents, including sales contracts, invoices, bills of lading and customs declarations, etc. and provide them to the beneficiary bank for settlement of the exchange. If said notice is sent to the beneficiary bank in a timely manner, it can be an effective warning, reminding the bank to be extremely careful when reviewing documents presented for the release of funds. Any delay in sending the notice may disadvantage the victim in the recovery of funds.

  1. Report to the police for criminal investigation

During a criminal investigation, the local police may decide to freeze all funds and payments, assuming the funds are still in the account, to prevent the fraudster from transferring them. It can be difficult to determine if funds are still in the account until the police get involved, as a bank may be unwilling to release account information for one of its customers and suspend the release of funds upon simple receipt of a notice. The bank is more likely to act on the basis of a police report or court order, obtaining of which will most likely delay the process and reduce the chances of the funds being withheld.

In accordance with the relevant provisions of the PRC Criminal Procedure Law, the police may, for the purpose of the criminal investigation, investigate or freeze the deposits, remittances and other assets of the suspects. However, the precondition for the police to take these steps is that they accept the case and establish their jurisdiction, which may not be straightforward in practice as it usually involves cross-border transactions.

  1. Apply for an Asset Preservation Order and File a Civil Action

In the event that the police in Mainland China refuse to accept or register the case, victims are advised to apply for an asset preservation order in the court where the receiving bank is located to freeze the bank account of the beneficiary, thus preventing fraudsters from transferring the funds.

PLEASE NOTEas required by PRC Civil Procedure Law, the applicant for a pre-litigation asset preservation order will be required to provide a counter-guarantee. In addition, substantive proceedings must be initiated within 30 days from the date the court issues the order. If the action on the merits is not initiated within the time allowed, the order is lifted by the court.


The methods used to carry out cyber fraud in international trade are constantly evolving and becoming increasingly sophisticated. It may be difficult to assess whether relevant information received from third parties is genuine or false. While it is always important to remain vigilant in the course of business, it is also good practice to seek the assistance of third party professionals (such as investigation companies, lawyers or insurance companies) to reduce the risk of being the victim of fraud, to mitigate losses and, more importantly, to maximize the chances of recovery in the event of fraud.


Comments are closed.