A payment schedule is not a risk control if the beneficiary, approval route and evidence behind each release have not been verified.
The proforma invoice is familiar, the email thread looks normal and the bank details arrive two days before the deposit is due. One digit—or the whole beneficiary—has changed. The expensive question is not whether the message sounds convincing. It is whether the buyer has a payment process that remains safe when an inbox, contact or document is compromised.
Scope: This is a procurement control method, not banking, legal, tax or credit advice. Use your bank, insurer and qualified advisers for the transaction, jurisdiction and payment instrument.
1. Map the five identities before the first payment
Record the legal seller, contracting party, manufacturing site, exporter of record and bank-account beneficiary as separate fields. They may legitimately differ, but the relationship must be explained and supported before money moves.
Start with the supplier evaluation guide, then obtain the contract, current registration evidence and bank instructions through controlled channels. A catalogue name, website brand or salesperson signature is not a substitute for the legal identity on the agreement.
| Role | Record | Control question |
|---|---|---|
| Contract seller | Exact legal name and address | Does this entity carry the contractual obligations? |
| Manufacturer | Legal name and production address | What is its documented relationship to the seller? |
| Exporter | Entity named in export records where applicable | Who will issue or appear on shipment documents? |
| Beneficiary | Account name, bank and country | Why is this entity entitled to receive the funds? |
| Authorised contacts | Named commercial and finance approvers | Which independent channel can confirm an instruction? |
2. Treat every bank-account change as a security incident
Do not verify a changed account by replying to the message that announced it. Pause the payment, use a previously verified phone or video contact, and require the agreed authorised documentation. A familiar email address is not proof that the sender or attachment is genuine.
The FBI’s Internet Crime Complaint Center describes business email compromise as a scheme that targets legitimate transfer requests and recommends verifying payment and purchase requests in person or by calling a known number. That principle matters even when the commercial request itself is real.
- Stop the payment workflow and preserve the original message and attachment.
- Contact the known representative using a number obtained before the change—not a number in the new message.
- Confirm the beneficiary name, bank, account, currency and reason for change field by field.
- Apply the buyer’s internal dual-approval and bank callback controls.
- Issue a written verification record and update master data only after approval.
- If funds were sent to suspicious details, contact the bank and the appropriate authorities immediately; do not wait for the supplier investigation.
3. Tie payment milestones to inspectable outputs
A date on a calendar is a weak release condition. A better milestone identifies the output, acceptable evidence, reviewer and consequence of a failed review. Deposits, custom finishes and material commitments may still be commercially necessary; the objective is to see what exposure each payment creates.
Separate evidence of activity from evidence of acceptance. A photograph of profiles in a workshop may show activity, but it does not by itself prove that the correct materials, quantities or approved configuration are ready.
| Possible milestone | Evidence to define | Open risk to record |
|---|---|---|
| Order release | Signed scope, controlled drawings, configuration and sample plan | Unapproved colours, glass, hardware or interfaces |
| Material stage | Identified material records and agreed verification route | Substitutions, excess prepayment and non-recoverable custom materials |
| Production completion | Inspection scope, results, exceptions and closure record | Units not sampled or unresolved non-conformities |
| Shipment release | Packing list, labels, loading evidence and transport documents | Damage, missing items, document discrepancies and destination charges |
| Final balance | Contract-defined completion evidence | Latent defects, installation scope and claims process |
4. Make deposit and refund conditions explicit
Write what the deposit authorises: design work, sample production, custom material purchase, production capacity reservation or mass production. Then state which amounts become non-refundable, at what event, and what evidence demonstrates that event.
A cancellation before custom powder coating is ordered is not the same as cancellation after profiles are finished or glass is cut. The contract should make that progression visible rather than arguing about a single word—deposit—after the fact.
- Amount, currency and due date
- Exact beneficiary and permitted payment channel
- Activities authorised by receipt
- Refundable and non-refundable portions
- Evidence of committed custom materials
- Effect of buyer or supplier delay
- Treatment of approved changes and rejected samples
- Refund method, bank charges and deadline
5. Control total exposure, not only the next invoice
Before approving a payment, calculate the buyer’s total unsecured exposure: money already paid, value of unverified work in progress, custom materials that may not be recoverable, and goods not yet under buyer-controlled shipment evidence. Compare that exposure with the buyer’s approved risk limit.
A low deposit percentage can still create high exposure if several orders overlap. Conversely, a higher payment may be rational when independently verified outputs and enforceable controls reduce uncertainty. The decision belongs to the buyer’s authorised commercial and finance process.
Exposure question: If the supplier stopped communicating today, what money, goods, documents and practical recovery routes would the buyer actually control?
6. Pre-review documentary-credit terms before issuance
A documentary credit is a document-based payment mechanism, not a factory-quality inspection. ICC explains that banks examine presented documents against the credit when UCP 600 applies. The buyer therefore needs documentary requirements that are clear, obtainable and aligned with the sales contract.
Review product description, latest shipment date, presentation period, partial shipments, transshipment, transport document, insurance document, certificate requirements and tolerance language with the issuing bank and trade-finance specialists before issuance. An impossible or ambiguous condition can create discrepancies without improving the goods.
- Does the credit expressly state the applicable rules?
- Can each required document be produced by the named party?
- Do descriptions and dates align across contract, invoice and logistics plan?
- Are partial shipment and transshipment provisions operationally realistic?
- Who pays amendment and discrepancy fees?
- What happens when the goods issue and documents issue are different?
7. Keep one payment decision record
Store the approved contract, beneficiary verification, invoices, account-change checks, milestone evidence, exceptions, approvals and bank confirmations under one order identifier. Do not leave the audit trail split across personal inboxes and chat groups.
Connect commercial payment decisions with the quotation comparison and the sample approval record. Scope, configuration and approval changes can alter both the amount due and the evidence needed before release.
| Field | Record |
|---|---|
| Order and invoice | [enter] |
| Approved beneficiary | [enter] |
| Independent verification channel and date | [enter] |
| Milestone and required evidence | [enter] |
| Evidence reviewed | [enter] |
| Exceptions and exposure | [enter] |
| Commercial and finance approvals | [enter] |
| Bank confirmation reference | [enter] |
FAQ
Should a buyer ever pay a company different from the factory?
Different entities can have legitimate roles, but the contract, beneficiary authority and relationship must be verified. Do not infer legitimacy from a salesperson’s explanation alone.
Is a video call enough to approve changed bank details?
It can be one control, but use the buyer’s agreed multi-channel verification and internal approval process. Deepfakes, compromised contacts and simple misunderstandings make a single signal inadequate.
Does a letter of credit guarantee product quality?
No. Banks deal with documents under the applicable credit terms. Product inspection, specifications, performance evidence and claims remain separate controls.
What should happen after a suspicious payment instruction?
Pause payment, preserve evidence, verify through established channels and follow the bank’s incident process. If funds were sent, contact the bank and appropriate authorities immediately.
Can a fixed payment percentage work for every order?
No universal percentage is safe. Product customisation, evidence, supplier history, enforceability, instrument, order overlap and buyer risk limits all matter.
Continue the project review
Connect this guide with the proposed window and door systems, then review how Cavorlen approaches manufacturing and quality control. When your schedule is ready, send it through the project review form.
Official sources used
FBI IC3 — Business Email Compromise ↗ICC — UCP 600 Uniform Rules for Documentary Credits ↗ICC Academy — Documentary credit questions for applicants ↗ISO — Guidance on documented information for ISO 9001:2015 ↗Related buyer guides
This guide describes buyer-side controls. It does not verify a beneficiary, guarantee recovery, recommend a payment instrument, or state that any transaction or supplier is safe.