Hacked Email, Fake Bank Details: Do I Still Owe My Chinese Supplier?

An email from your Chinese supplier says it has a new bank account. You pay the balance there. Weeks later, the supplier says it never got the money. The account belonged to a fraudster, and the supplier still wants to be paid.

The answer depends mainly on two things. Whose email system did the fraudster use? And did you check the change before paying? If the supplier still wants the money, I handle supplier disputes like this.

Why the payment may not count

Under the Civil Code, a debt ends once it has been performed (art. 557). A buyer performs by paying the agreed amount in the agreed way (arts. 509 and 626). Usually, that means the account named in the contract or proforma invoice (the invoice a seller issues before you pay). Money sent to a fraudster hasn't reached the supplier. So the starting point is that you still owe the price.

The fraud doesn't change that. Breach means failing to do what the contract requires. If a third party causes one side to breach, that side is still liable to the other. Its dispute with the third party is a separate matter (art. 593).

What courts look at

In the two cases below, four points decided who bore the loss:

• whose email system was used: the supplier's own account, or a forgery from outside;
• whether the email looked normal and fitted the earlier thread;
• whether the buyer checked by phone or video, or relied on the email alone;
• whether the two sides had any channel other than email.

A case where the payment counted

In a 2014 case, the Ningbo Intermediate People's Court in Zhejiang looked at an Italian buyer of conveyor belts. Buyer and supplier had only ever dealt by email. The buyer paid a 30% deposit into the supplier's account. Then the supplier's usual email address sent several notices of a new account, in a private person's name. In the same days, it also discussed a quality issue and the bill of lading (the shipping document). The buyer paid the USD 10,721 balance into the new account.

The supplier said its mailbox had been hacked. The court found the evidence for that insufficient. Even if someone else had controlled the mailbox, the emails showed nothing obviously odd or contradictory. And there was no other channel. So the buyer had good reason to trust them and was not at fault. The supplier had failed to protect its password and had to bear the loss. The supplier then refused to ship, so it had to refund the whole USD 15,316 price, with interest ((2014) Zhe Yong Shang Wai Zhong Zi No. 16). The court applied the old Contract Law. Its full-performance rule is now art. 509 of the Civil Code.

Don't count on that result. It rested on email being the only channel. If you could easily have phoned, a court may expect you to.

A case where the buyer lost the money

The Guangzhou Intermediate People's Court reached the opposite result in 2025. The buyer, a Hong Kong company, had paid a mainland supplier a USD 13,725 prepayment. Then an email asked it to send the USD 32,025 balance to a new account, and it did. The supplier's email provider confirmed that the email hadn't gone through its servers. A third party had forged it.

The court held that a business should check before sending a large payment to a last-minute new account. It should check by phone, video or another channel. This buyer hadn't. It had simply asked an outside party to send the money, which was careless. Nothing showed that the supplier had received it. The court saw no legal basis to treat it as paid to the supplier. The buyer lost the USD 32,025.

The supplier still couldn't keep everything. The two sides had agreed to end the contract. The buyer hadn't meant to refuse or delay payment. The supplier hadn't proved the goods were custom-made and impossible to resell. It hadn't delivered them, so it could still sell them to someone else. It had to return the prepayment ((2025) Yue 01 Min Zhong No. 25147).

If both sides were careless

Fault can count against the supplier too. Each side must give the notices that good faith calls for (Civil Code art. 509 para. 2). Where both sides breach, each bears its own share (art. 592 para. 1). Where the supplier's own fault helped cause its loss, its damages can be reduced (art. 592 para. 2). Damages are money paid to make up for a loss, such as interest for late payment.

In my view, a supplier that knew its mailbox was hacked and didn't warn you is in a weak position. You can argue that it should share the loss, or at least that it can't claim interest and costs. How far a court goes will depend on the facts.

What to do first

• Contact your bank at once and ask it to try to recall the payment.
• Keep the fake emails in their original form, with the full headers. A header shows which server really sent an email. In the Guangzhou case, the email provider's answer on that point was key evidence.
• Tell the supplier in writing what happened. Ask whether its mailbox was hacked, and whether it knew before you paid.
• If the money went to an account in mainland China, you may be able to sue the account holder. Chinese law lets you claim back money someone received without a legal basis (Civil Code art. 985).

My evidence checklist lists what else to save. If the supplier now refuses to ship and keeps your deposit, see how to recover money from a Chinese supplier.

How to stop it happening

Write the payment account into the contract, and say how it can change. A company chop is the company's official seal.

Before each payment, check that the account holder matches the supplier's registered Chinese name. Is the account in a person's name, another company's name or a different country? I would treat that as a reason to stop and call. Run the free payment self-check before you pay. My guide to checks before paying a Chinese supplier shows how to match the contract party, invoice and payee.

Did you pay a new account after an email, and now the supplier says it wasn't paid? Send me the contract or order, the payment record, the supplier's Chinese company name and its last message. The fake email, with its full header, helps too. I'll tell you where you stand and what your options are. Describe your situation →

Part of my guide to supplier disputes in China.

This article is general information on PRC law. It isn't advice on any particular matter.