Cross Border Payment Fraud: Causes, Common Scams and How to Prevent It

Cross border payment fraud is any scheme in which criminals use the movement of money between countries to steal funds or to launder them. It works because an international payment passes through several banks, rules and time zones, so a fake instruction or a false payee is harder to spot and much harder to pull back.

In most cases, someone is tricked into sending money to the wrong account, accepting a payment that never really arrived, or letting their own account carry stolen funds. Businesses and individuals are both targets, whether you are paying a supplier abroad or receiving money from a client.

Knowing why cross border payment fraud happens helps you spot the weak moment in your own payments, and knowing how each scam works tells you which check to use. Banks already block some of it, but simple habits close most of the gap, and acting quickly after a loss gives your bank the best chance to help.

A payment that crosses a border passes through more hands than a local one, and each handover is a gap a fraudster can use. Four causes stand out, as described in a February 2026 report by an industry task force working under the Bank for International Settlements (BIS).

• Rules differ from country to country - Each country sets its own fraud controls and customer checks, and banks and non-bank payment firms often apply them differently. Privacy laws also stop firms from sharing data across borders, so a fraudster flagged in one country can look clean in the next.
• Speed leaves little time to check - Payments are getting faster, while checks made before a payment leaves are still at an early stage.
• People are tricked into paying - In authorised push payment scams, the victim sends the money themselves after being fooled by impersonation, fake invoices or false supplier accounts. The rise of these scams is a main reason regulators now focus on cross-border fraud.
• Shell companies and money service businesses hide the trail - Money service businesses and shell companies in places with light oversight can be used to move funds, and genuine company accounts can be taken over and used as a front.

A well-known case shows how much is at stake. In 2016, criminals sent fake SWIFT instructions from Bangladesh Bank's account at the Federal Reserve Bank of New York, and about USD 81 million was stolen, out of roughly USD 951 million the thieves tried to move, according to Bangladesh Bank.

Card payments carry the same exposure: in the first half of 2023, 71% of the value of card fraud in the European Economic Area involved cross-border transactions, according to the European Central Bank and European Banking Authority.

Most international payment scams fall into five types. Each one targets a different moment in the payment, so the defence for one does not always cover the next.

Business email compromise and fake supplier invoices

Business email compromise is a scam in which a criminal takes over a trusted email account, often after a phishing email that steals the login, or sets up a lookalike address. Account takeover lets them send payment instructions that look genuine. A common version, invoice redirection, is a message from a "supplier" saying their bank details have changed, so the next invoice is paid into the criminal's account.

It is one of the costliest frauds reported to the FBI. IC3, the FBI's internet crime complaint unit, recorded reported business email compromise losses of about USD 3.05 billion in 2025, second only to investment fraud.

What makes this kind of wire transfer fraud dangerous across borders is that the money often cannot be called back. These wire transfers are often hard or impossible to reverse, which is why US regulator FinCEN has repeatedly warned about email-compromise fraud, so confirm emailed payment instructions through more than one channel. The simplest defence is to call the supplier on a number you already hold before paying any new account.

Authorised push payment scams and impersonation

An authorised push payment (APP) scam is one where you are tricked into sending a payment yourself, to a fraudster or for a purpose that is not what you believe. The criminal might pose as your bank, a tax office, a delivery company, a romance partner or an investment adviser, and the payment goes through because you approved it.

Authorised push payment losses in the UK rose 19% to GBP 576 million in 2025, according to UK Finance, while unauthorised fraud losses fell 5%. About two in three cases began online.

• Impersonation - A caller or message claims to be your bank, the police or a government office and says your money must be moved to a "safe" account.
• Purchase and investment scams - You pay for goods, a job deposit or an investment that does not exist, often to an account in another country.
• Romance and family scams - Someone you have only met online asks for money for travel, a medical bill or a fee to release funds.

Many of these are wire transfer scams, where the victim sends a bank transfer abroad that cannot easily be reversed. One point matters if you live outside the UK. The UK has a mandatory refund scheme for APP scams, but it covers only Faster Payments and CHAPS transfers between two UK accounts and does not apply to international payments, so money you send abroad has no such protection.

Fake payment proof and overpayment scams

Fake payment proof and overpayment scams target the person being paid. A buyer or "client" shows you proof that money is on its way, so you deliver work, ship goods or send a refund before any real money reaches you.

• Fake payment proof - You receive a screenshot, an edited bank advice or a copy of a SWIFT message showing a transfer. None of these proves the money arrived; only a credit in your own bank account does.
• Overpayment - The payer sends more than the invoice, by mistake they say, and asks you to return the difference. The original payment later bounces or is reversed, and the money you returned is gone.
• Cheque and card versions - The same trick uses a cheque or a stolen card that clears at first and is pulled back days or weeks later.

The amount and currency vary, from a few hundred USD, GBP or EUR to large invoices in CAD, AUD, AED or SGD, but the pattern does not. Pressure to act before the money settles is the clearest warning sign.

Chargeback fraud and card-not-present fraud

Card-not-present fraud happens when someone uses stolen card details to buy online, by phone or through an invoice link, where the card is never shown. When the real cardholder spots the charge, they dispute it and the seller loses both the goods and the money.

Chargeback fraud is the twist where a genuine customer buys, receives the goods or service, and then disputes the charge anyway, claiming it was never delivered or never authorised.

Card network rules typically let a cardholder dispute a payment for up to 120 days, and longer in some cases, so a sale is not truly settled when the money lands. Keep delivery proof, signed scopes of work and customer emails for every card sale, because those records decide whether you win a dispute.

Money mule accounts and trade-based laundering

A money mule is a person who lets their bank account receive and pass on stolen money, knowingly or not, and the account they use is called a mule account. Criminals usually recruit mules in one of three ways:

• Fake job offers that pay you to "process payments"
• "Payment agent" roles for an overseas company
• Requests to borrow your account for a few transfers

The money mule's account is then used to move fraud proceeds across borders, which is why banks now hunt for mule accounts so actively.

If you act as a mule, your account can be frozen and you can face legal trouble. Payee name checks cannot stop mule accounts, because the name on a mule account is real.

MuleHunter.AI is a machine-learning model built by the Reserve Bank Innovation Hub, which the Reserve Bank of India piloted with banks and has encouraged banks to use to detect these accounts.

Trade-based laundering works by invoicing goods at the wrong price or billing for shipments that never happen. If a buyer asks you to change invoice values, split payments across accounts or accept money from an unrelated third party, decline it and tell your bank.

Banks, payment networks and regulators already run several checks against cross border payment fraud before and after a payment moves. None is complete on its own, so each one covers a different gap.

Swift Payment Pre-validation is a set of tools a bank calls before it sends a payment instruction, to check the beneficiary account and details. Swift launched Payment Pre-validation in 2021, and banks join it by subscription, so coverage is not yet universal. Its aim is to cut failed payments and confirm the money goes to the right payee.

Industry groups and regulators are also discussing wider fixes, such as sharing fraud data between countries and using AI to spot unusual payments. Until those exist everywhere, payee checks confirm a name but cannot judge intent, so your own checks still matter.

The strongest protection against international payment fraud is a short set of rules that everyone follows, every time, for both money going out and money coming in. Most of these scams work only when one person acts alone, in a hurry, on an email or a screenshot.

A written process that you and your team follow removes that gap without slowing normal payments. Our guide to payment security covers the wider technical side.

When you send money abroad

• Confirm every change of bank details by phone - Call the supplier on a number from your records, not from the email asking for the change, and do this even for long-standing partners.
• Use two people for every new payee - One person sets up or changes a beneficiary and a second approves it, so a single tricked employee cannot release money.
• Check the payee before the first payment - Use your bank's name check where it exists, search a company's LEI or registry entry, and send a small test amount before a large one.
• Slow down when someone rushes you - Urgency, secrecy and a new account in a different country from the supplier are the usual signs of a scam.
• Keep payment credentials apart from email - Never share one-time passwords or login details, and switch on two-factor sign-in for email and banking.

Individuals sending money to family or for purchases should apply the same rule: if you have only met the person online, do not send money abroad to them. Our secure payment guide walks through safe ways to pay online.

When you are the one being paid from abroad

These four rules keep a fake payment from costing you money.

• Wait for the credit, not the proof - Ship work or goods only when the money shows in your own bank or payment account, never on a screenshot or a forwarded SWIFT copy, whichever way you receive international payments.
• Never refund an overpayment early - Wait until the original payment has fully settled, then return the extra only to the same account it came from.
• Tell clients your details never change by email - Put one line on every invoice saying you will confirm any change by phone, so a fake email from "you" is easy to spot.
• Keep records for card sales - Save delivery proof, approvals and messages so you can answer a chargeback within the card network's deadline.

For export income in India, a Foreign Inward Remittance Advice (FIRA) or its electronic form, the eFIRA, is the record of the inward payment. That record shows the money truly arrived and why.

If a payment seems late rather than fake, track a cross-border payment with its reference number before you act.

If you have lost money, speed matters more than anything else. Contact your bank first, then report the fraud to the police channel, and keep every email, message, invoice and payment reference. Report on the national cybercrime helpline 1930 or at cybercrime.gov.in, so police and banks can act on the receiving accounts.

A recall, such as a SWIFT recall for a bank wire, is a request to the receiving bank, not a promise that the money comes back. Your bank asks the other bank to return the funds, and success depends on whether the money is still there and on that bank's policies. If a US account received the money, the FBI asks victims to contact their bank and file at ic3.gov whatever the amount.

In the US, an ACH reversal is allowed only for a duplicate payment, wrong amount or wrong account, among a few other narrow cases, and must be made within five banking days of the original payment's settlement date.

If your bank does not resolve your complaint, you can go to the Reserve Bank of India (RBI) Integrated Ombudsman. The Reserve Bank - Integrated Ombudsman Scheme, 2026, came into force on 1 July 2026 and replaced the 2021 scheme.

Complain to your bank first; if it does not reply within 30 days, or you are unhappy with the reply, file at cms.rbi.org.in within 90 days after that period. The ombudsman reviews how your bank handled the complaint and does not recover money from the fraudster.

At Xflow, we run separate products for different money flows, and each has its own rules. As of February 2026, Xflow Payments India Pvt. Ltd. holds final PA-CB authorisation (Payment Aggregator - Cross Border) from the RBI. Final means the fully approved stage, past in-principle, and it applies to our Export and Import products below.

• Security and banking - We are ISO 27001 and SOC 2 certified, and we work with Authorised Dealer Category-1 (AD-1) banks for foreign exchange, compliance and documentation.
• Export, receiving money into India - Indian businesses and freelancers receive payments from clients in 140+ countries, with settlement on the next business day and an eFIRA for each payment as a record that the money arrived.
• Import, collecting from Indian customers - Companies outside India can accept payments from India by UPI, cards and netbanking, typically settled abroad in two business days.
• Stablecoin settlement - A separate product for invoice-backed business payments in USDC or USDT. With stablecoin settlement, the coin is converted outside India and the Indian recipient is paid in INR, with an e-FIRA on every transaction.

Every customer completes KYC checks before they can use our products.

Here is how that setup closes the gaps these scams rely on:

• Proof that money really arrived - With Xflow Export, the money lands in your account and you get an eFIRA, the digital form of a FIRA, for each payment, so a screenshot or forwarded SWIFT copy never has to stand in for a real credit. That removes any need to rely on a screenshot or forwarded SWIFT copy as proof of payment.
• Fewer hands on the money - Clients pay into local account details in USD, EUR, GBP or CAD through our receiving accounts, usually by local transfer in their own country.
• Regulated channels only - Every payment runs through our RBI-authorised setup and AD-1 bank partners, and stablecoin settlement is limited to invoice-backed business payments, not personal transfers.
• Known settlement times - Export settles the next business day and Import usually in two business days, so a payment that is late stands out quickly.

Cross border payment fraud succeeds when a payment moves faster than anyone checks it. Most losses come from people being tricked, so the defence is mostly habit: call before you change payee details, and wait for a real credit before you deliver or refund. If money does go missing, contact your bank at once and report it on 1930 or cybercrime.gov.in.

• Before you pay - Confirm any new or changed bank details by phone, and use a second approver for every new payee.
• Before you deliver or refund - Wait until the money shows as a credit in your own account, whatever the screenshot says.
• After a loss - Ask your bank for a recall, report the fraud, and keep every email, invoice and reference.