Security researchers just unmasked a fraud operation that has been running quietly for more than nine years: nearly 100 fake websites impersonating major industrial companies — fertilizer makers, petrochemical plants, metal producers, logistics firms, even banks — built to trick businesses around the world into wiring advance payments for goods that never existed. The sites were near-perfect clones of the real companies’ websites, offered in four languages, with exactly one thing changed: the contact details. One documented victim, a company that thought it was buying from a legitimate supplier, wired roughly $150,000 for a shipment that was never coming.
The impersonated companies happen to be Russian and the victims were mostly overseas buyers — but strip away the geography and what’s left is the single most transferable fraud playbook we’ve covered this year, because it targets something every business does: finding and paying suppliers you’ve never met in person. Let’s walk the playbook, because your bookkeeping is exactly who it was written for.
The nine-year playbook, at a glance
| The storefront | Nearly 100 lookalike domains cloning real companies’ websites — same content, same photos, same product pages — with only the phone, email, and banking details swapped |
| The approach | Cold calls and professional emails offering goods at attractive terms; in some cases the crooks hired unwitting, legitimate sales reps to make first contact, handing victims to a “senior manager” at contract time |
| The paperwork | Forged commercial proposals, contracts, and invoices — polished, official-looking, and carrying the banking details of shell companies posing as “subsidiaries” |
| The payoff | Advance payment wired for goods that never existed; one documented loss ran about $150,000 on a single deal |
| The audacity award | When real companies posted fraud warnings on their websites, the crooks copied the warnings onto the fake sites too — with the domain names swapped, so the warning itself vouched for the fraud |
Sit with that last row for a second. The scammers’ clone of the company website even included the company’s own warning about scammers — edited to point at the real site as the fake one. That is how completely a website can lie to you. A professional site, correct content, plausible paperwork, a salesperson on the phone: none of it is proof anymore. The only thing a fraudster cannot fake is what you verify through an independent channel.
You do this too — just smaller
You may never buy petrochemicals from overseas, but think about how modern small businesses actually source things: a search for a wholesale supplier, a promising website, a responsive salesperson, a professional quote, an invoice with wiring instructions, a deposit to get production started. Every step of that ordinary process is a step this playbook was built to exploit. And its close cousins are already in your inbox — the “vendor” announcing new banking details, the fake payment paperwork we dissected from our own inbox, the too-good equipment deal from a site registered three weeks ago. Advance-payment fraud is not an exotic international problem. It is a “your deposit for the new walk-in cooler” problem.
The verify-before-you-wire rules
- Verify the company, not the website. Look the business up in official registries and independent directories, and reach it through contact details from those sources — never solely the ones on the site or the invoice in front of you.
- Check the domain’s age and spelling. A “major supplier” whose web address was registered last month, or that differs from the official one by a hyphen or an extra word, is your answer.
- Treat banking details as radioactive. Before the first wire — and before honoring any change in payment details — confirm by phone, using a number you found independently. This one habit defeats this entire campaign and most of its cousins.
- Be suspicious of advance-payment-only terms. Unusually attractive prices plus full prepayment plus time pressure is the fraud trifecta, in any industry, at any size.
- Make it a rule, not a judgment call. “No new payee and no changed banking details get paid without independent phone verification” — written down, applied every time, no exceptions for busy days. Busy days are when it works.
The one-line takeaway: a wire transfer is trust converted to money — and websites, paperwork, and friendly voices can all be counterfeited. Verification through a channel you chose is the only signature a fraudster can’t forge. Nine years and a hundred fake companies say most businesses haven’t learned that yet.
Make the habit automatic
Rules on paper only help if the people paying the invoices apply them under pressure, on the busy Friday, with a convincing voice on the phone. That reflex is built, not wished for — and it’s exactly what our focused, plain-language security training drills: the verify-before-you-wire habit, the payment-change callback, and the healthy suspicion of urgency, practiced on the real lures your team will actually face. The crooks in this story spent nine years perfecting their side of the phone call. One training session is all it takes to make sure your side is ready.
Sources: F6 research via The Hacker News; TechNadu; SC Media, July 2026.
