Online order fraud is one of those threats that looks nothing like fraud until it’s too late. No smash-and-grab, no obvious red flags mid-conversation. The company checks out. The credit references are solid. The order looks like a win. Then the goods ship, and you’re chasing an invoice that will never get paid.
Understanding how this fraud pattern works, and where trade credit insurance does and doesn’t apply, could save you a significant loss.
How sales order fraud works
Every case is a little different, but the pattern is consistent enough that once you’ve seen it described, you’ll recognize it.
It starts with a first-time buyer. The order is large, often unusually so for a new account. The buyer submits clean credit information and provides trade references that check out on the surface. They want the order processed quickly and make clear there’s a deadline. The company name and email address look legitimate, close enough to a real creditworthy business to pass a casual review.
The transaction moves forward. Goods go into production or get pulled from inventory. Then, somewhere in that window, the buyer requests a change to the shipping instructions. The destination shifts, often to a different warehouse, a freight forwarder, or a port that doesn’t match the original order. It can seem routine. By the time the invoice comes due, the entity on the other end of the transaction isn’t one you can collect from.
The FBI’s Internet Crime Complaint Center consistently ranks business email compromise and related fraud among the highest-loss cybercrime categories for U.S. businesses. Sales order fraud runs on the same playbook.
Trade credit insurance’s involvement
Trade credit insurance is built to cover non-payment by a buyer you’ve been approved to sell to. Carriers underwrite specific buyers, assign credit limits, and pay claims when those buyers default. The system works well for the credit risk it was designed for.
Sales order fraud breaks the model at one specific point: the entity that receives the goods is never the entity covered on the policy.
The fraudster is careful about this. The invoiced company is close enough to a legitimate business to pass initial scrutiny. Same or similar name. Different address. A slight variation in the legal entity. Close enough to fool a busy sales team, not close enough to be the actual insured buyer. When a claim gets filed, the carrier’s position is clear: the covered buyer didn’t default because the covered buyer was never actually party to the transaction.
This isn’t a gray area in policy language, and it’s why fraud losses of this type tend to fall entirely on the seller.
What makes these transactions hard to catch
Fraudsters running this scheme count on a few things working in their favor.
The urgency is built in. First-time orders rarely get the same scrutiny as repeat business, and a rushed timeline pushes people to move rather than verify.
The references hold up, at least initially. In some cases, the trade references the buyer provides are real companies whose information has been appropriated. In others, they’re fabricated but hard to disprove quickly.
The shipping change feels routine. Address updates happen in legitimate orders all the time. A request to redirect to a third-party logistics provider or alternate port doesn’t automatically read as fraud, especially when everything else about the order looked clean.
By the time the pattern is obvious, the goods are gone.
What actually helps
Trade credit insurance won’t cover this exposure, but that doesn’t mean sellers are left without options. The protection here comes from process.
Independent verification on new accounts matters more than most companies realize. Don’t rely solely on the references the buyer provides. Cross-check company details through independent sources and confirm the physical address matches the legal entity. A quick search of state business registration databases takes a few minutes and catches a surprising number of inconsistencies.
Shipping change authority is worth formalizing. Any mid-order change to a delivery destination should require written authorization from a verified contact at the original purchasing entity, confirmed through a channel you initiated rather than one the buyer provided.
Slowing down rushed orders from new accounts removes one of the primary levers these fraudsters use. Urgency is a feature of this fraud, not a coincidence. A policy that requires additional verification for large first-time orders, regardless of how complete the credit application looks, changes the risk profile considerably.
Putting it together
If you’re already using trade credit insurance for your receivables portfolio, this kind of fraud is worth treating as a separate exposure. Your policy is doing what it was built to do. It just wasn’t designed for a transaction where the named buyer never actually took delivery.
Other products like political risk insurance address different categories of non-payment risk, but none of them close this particular gap cleanly. The right response is operational controls, not a different insurance product.
If you’re seeing patterns in your order flow that match the profile above, or want to understand how your current coverage is structured relative to this risk, reach out to us. It’s a straightforward conversation.
Disclaimer:
This blog post is meant to be informative and provide helpful tips and insights into credit insurance policies. It is not meant to supersede any policy requirements. Please consult your credit insurance policy for all requirements including claim filing deadlines and required documentation.
Since 2004, Securitas Global Risk Solutions, LLC has helped clients develop trade credit and political risk transfer solutions. As an independent brokerage, Securitas is focused on developing comprehensive solutions that meet client needs, ensuring a complete understanding of policy wording and delivering excellent responsive service.

