Avoiding common payment scams when buying from a new supplier

Most businesses you deal with are honest. The few scams that do happen tend to follow a small number of well-known patterns. Knowing them makes you much harder to fool, whether you are a customer paying a supplier or a business owner paying your own vendors.

“Our bank details have changed”

This is one of the most costly frauds affecting businesses worldwide. A criminal gains access to, or imitates, a supplier’s email account and sends a message saying the supplier has a new bank account. The next payment goes to the criminal.

How to protect yourself: whenever you receive new or changed bank details, call the supplier on a phone number you already had, not one given in the email, and confirm the change with someone you know. Look closely at the sender’s address; fraudsters often use a domain that differs by one letter.

Prices that are too good to be true

Fake sellers attract buyers with prices well below the market, often for electronics, vehicles and vehicle parts, building materials or imported goods. They ask for full or large advance payment and then stop responding.

How to protect yourself: compare prices from several businesses. If one is far cheaper than all the others, ask why. Pay a small deposit at most, and pay the balance on delivery or after inspecting the goods.

Pressure to pay immediately

“Only two left”, “the price goes up tomorrow”, “pay now or lose the booking”. Urgency is used to stop you from checking. Genuine businesses will usually hold a quotation for a reasonable time.

How to protect yourself: give yourself time to run the checks in our business verification checklist. If a seller won’t wait an hour for you to do that, walk away.

Unusual payment methods

Requests to pay using gift or top-up cards, cryptocurrency, money transfer to a third party’s personal account, or “processing fees” before a prize or loan is released are almost always fraudulent.

How to protect yourself: pay by bank transfer to an account in the business’s registered name, or by card through a well-known payment provider that offers some protection.

Fake delivery and payment messages

SMS and WhatsApp messages claiming that a parcel is held, a payment failed or an account will be closed often contain links to pages that imitate a courier, bank or payment service. They ask for card details or one-time passwords (OTPs).

How to protect yourself: never share an OTP with anyone; banks and couriers do not ask for it. Open your bank’s app or type the courier’s website address yourself instead of tapping links in messages.

Impersonating a real business

Scammers sometimes copy the name and logo of a real, well-known business and create a new social media page or phone number. Always contact businesses through details you have checked, such as their official website or a directory listing that has been reviewed, and be cautious of accounts that were created recently.

If something goes wrong

1. Contact your bank immediately. The sooner the bank is told, the better the chance of stopping or recovering a transfer.
2. Keep the evidence: messages, emails, phone numbers, receipts and bank references.
3. Report it. Make a complaint to the police. Online fraud and phishing can also be reported to Sri Lanka CERT.
4. Tell us if a BizGrid.lk listing was involved. Use the Report this listing link on the profile or contact us so we can investigate and protect other users.

For business owners

The same rules protect your own business: confirm any change of bank details by phone, limit who can approve payments, use strong, unique passwords with two-step verification on your email, and warn your customers that you will never change your bank details by email alone.