Due diligence
How to verify an overseas buyer before you ship
Checking a buyer costs about ninety minutes. Not checking costs one container, the freight both ways, and a legal process in a country whose courts you have never seen.
Export fraud is rarely sophisticated. It is a company that does not exist, a company that exists but is not the one emailing you, or a real company placing an order it has no intention of paying for. All three are cheap to detect and expensive to discover late.
Run the checks in this order. Cheapest and most decisive first, so the bad prospects drop out before you have spent real time on them.
Run checks 1 to 4 on every new buyer. They take twenty minutes. Run 5 to 9 before you ship on anything other than advance payment or a confirmed letter of credit. A first order under full prepayment carries almost no risk and does not need the full battery, though I would still do 1 to 4, because they also tell you whether the account is worth your time.
The nine checks
-
Does their shipment history exist?
Fastest test, most decisive, and almost nobody runs it. A genuine importer of ceramic tiles has imported ceramic tiles before. Search the company name in shipment records and look for shipments of your product category, at a plausible cadence, in the recent past.
What each outcome means:
Result Reading Regular imports of your category Strong. Proceed, and read their incumbent supplier while you are in there. Imports, but of unrelated products A trader or a diversifying buyer. Legitimate, but ask why now. Imports that stopped 18 months ago Ask what changed. Sometimes a business wound down, sometimes it lost credit. Nothing at all Not proof of fraud. Coverage is partial, and land, intra-EU and courier trade often leaves no record. Take it as a prompt to lean harder on checks 2 to 4. -
Is the company registered, and is the person emailing you part of it?
Nearly every jurisdiction has a public register. Look for incorporation date, registered address, status (active, dissolved, in liquidation) and directors. Then check the name in the signature block against the directors or the company's own site.
Public company registers for markets Indian exporters commonly sell into. Country Register Free? United Kingdom Companies House Yes, filed accounts included Germany Handelsregister / Unternehmensregister Search free, documents paid Netherlands KVK Handelsregister Basic search free France Infogreffe / RNE Partly free Italy, Spain, Poland National chamber-of-commerce registers Varies USA Secretary of State, per state Yes, but state by state UAE Free-zone authority or DED licence lookup Licence check yes Singapore ACRA BizFile Paid extracts Australia ASIC / ABN Lookup Yes Two mismatches matter most. A registered address that turns out to be a residential flat or a virtual office when the company claims a warehouse. And a company incorporated three months ago that describes fifteen years of trading.
-
How old is the domain, and does the email match it?
A WHOIS lookup gives you the domain's creation date in about ten seconds. A buyer claiming a decade of importing whose domain was registered five weeks ago is the most reliable red flag on this list.
Check that the email domain is the company's own, too. A "procurement manager" writing from Gmail, or from
company-purchase.comwhen the real site iscompany.com, is either not who they say or is being impersonated. Look-alike domains are the mechanism behind most payment diversion fraud. -
Does the story reconcile?
Three numbers should roughly agree: the size of the order, the size of the company, and the size of their existing import programme. A five-person trading company ordering four containers on open account is not impossible, but it is a question. Ask it early and directly. Real buyers answer it without any difficulty.
-
Sanctions and denied-party screening
Not optional, and not only for obviously sensitive goods. Screen the company, its directors and the destination against the UN consolidated list, the EU sanctions map, OFAC SDN if any USD payment or US nexus exists, and the UK sanctions list. Screen the intermediate parties as well: the bank, the notify party, the vessel's operator where relevant.
A violation here is not a commercial problem. It is a regulatory one.
-
Credit standing, from someone who has actually been paid by them
ECGC provides buyer credit reports and cover for Indian exporters, and a report costs a small fraction of one shipment. Commercial credit agencies cover most markets. What you want is payment behaviour rather than a rating: how they have actually paid other suppliers.
If the buyer offers trade references, call them. Two questions do the job. How long have you supplied them, and have they ever paid late?
-
Match the payment terms to what you now know
This is where due diligence turns into a commercial decision. Terms are the control:
Terms Your risk Appropriate when Advance payment (T/T) None First order, unknown buyer, small value Confirmed irrevocable L/C Very low, a bank in your country pays Larger first orders, higher-risk markets Unconfirmed L/C Issuing-bank and country risk remain Established buyer, strong bank, stable market Documents against payment (D/P) Buyer can refuse, goods sit at destination Repeat buyer with a payment record Documents against acceptance (D/A) High, they hold the goods and a promise Long relationships, or with credit insurance Open account Full Only with ECGC or private credit cover in place A buyer who refuses every instrument that protects you, on a first order, has already told you what you need to know.
Terms are the control that survives when the checks turn out to be wrong. A first order belongs on the left of this line whatever the buyer's story. -
Verify banking details out of band, every time
Payment diversion fraud does not target new relationships. It targets established ones. An email arrives, apparently from your buyer, saying the bank account has changed. It is the most common six-figure loss in export, and it works because everything about it looks routine.
The rule is absolute. Never accept changed bank details over email. Call a number you already had, not the one in the new email, and confirm with a person you have spoken to before. Apply the same rule in reverse. If a buyer rings to check your details, thank them.
-
Size the first order so a total loss is survivable
All the checks above reduce risk. None of them eliminate it. The last control is arithmetic. A first shipment should be small enough that if everything fails, no payment, goods gone, no recourse, the business absorbs it. If the buyer insists on a large first order under weak terms, that insistence is itself the finding.
Red flags, ranked
| Flag | Why it matters |
|---|---|
| Bank account in a different country or a different name from the buyer | Close to conclusive. Legitimate buyers pay from their own accounts in their own jurisdiction. |
| Bank details changed by email mid-transaction | The classic diversion. Assume compromise until verified by voice. |
| Domain registered weeks ago while the company claims years of trading | Cheap to check, hard to explain away. |
| Pressure and urgency, "ship today or we cancel" | Urgency exists to prevent checks. That is its only function here. |
| Large first order, no negotiation on price | Real buyers negotiate. Someone who never intends to pay does not care what the price is. |
| Refuses a video call or a factory visit | Twenty minutes on camera resolves most doubt. Refusal is itself data. |
| Free-email address, or a near-miss look-alike domain | Check character by character. An rn reads as an m. |
| Vague on specification, precise on quantity and delivery | They are not buying your product. They are acquiring goods. |
| Asks you to pay a "registration", "certificate" or agent fee | Advance-fee fraud wearing an export costume. |
No trade dataset covers every shipment through every port, in every year, in both directions, and import-side coverage is thinner than export-side. So "no record found" means the record is not in this data. It does not mean the company does not import. Use a blank as a reason to weight the registry, domain and reference checks more heavily, never as a verdict on its own.
The twenty-minute version
- Search the buyer's name in shipment records. Note what they last imported, and when.
- Look up the company in its national register. Note incorporation date, status, address.
- WHOIS the domain, then compare the creation date to the claimed trading history.
- Check the email domain character by character against the real website.
- Screen the company and its directors against sanctions lists.
- Reverse-image-search the "office" or "warehouse" photos, if any were sent.
- Set terms that match what you found, and then hold them.
Seven steps, one coffee. Then write to them properly, using what you learned, which as it happens is also the difference between an email that gets a reply and one that does not. That is covered in the cold email post.
