The short answer: November is the highest-fraud month in the China sourcing calendar because three things collide: fair-season deposits are being wired by buyers who met suppliers days ago, the pre-Chinese-New-Year production rush creates real deadline pressure that scammers imitate, and payment inboxes are busy enough that a changed bank account slips through. The patterns to watch: payment-diversion emails ("our bank account changed"), phantom ready-stock offers with pre-holiday urgency, entity swaps between the quote and the contract, fake or recycled inspection reports, too-good pricing from "new factories," and goods substituted at loading. Every one of them is beaten by the same two habits: verify bank details out of band, and verify the goods and the entity before money moves.
Why November, specifically
Scams in this trade are not evenly distributed across the year. They cluster, and the cluster has a calendar logic.
The deposit window. The 140th Canton Fair closed on November 4. In the two to four weeks after the fair, tens of thousands of buyers move from booth conversations to first orders. That means November is when the largest number of importer–supplier relationships are at their youngest, their least verified, and their most payment-active, all at the same time. Fraud follows money in motion, and November is when the money moves.
The production squeeze. Chinese New Year falls on February 6, 2027, eleven days earlier than in 2026. Factories stop taking comfortable orders in early December, workers start leaving in January, and every buyer who hesitated in October is now in a hurry. Hurry is the scammer's raw material. Every fraud pattern in this article borrows its credibility from a deadline that is genuinely real.
The volume peak hides the noise. This is not anecdote; it shows up in national trade data. China's monthly exports of goods, averaged over 2021–2025, run about $295–310 billion for most of the year, then peak in November and December at roughly $309 and $326 billion respectively, before collapsing to around $213 billion in February when the holiday shuts the factories down.
Monthly exports of goods, China, average 2021–2025, not seasonally adjusted. Source: IMF International Financial Statistics via FRED (series VALEXPCNM052N).
More cargo moving means more payments moving, more invoices flying between people who barely know each other, and more chances for a fraudulent thread to look like ordinary year-end traffic.
The macro baseline is already bad. Payment-diversion fraud, known formally as business email compromise (BEC), is not a fringe event. The FBI's IC3 recorded $3.05 billion in reported BEC losses across 24,768 complaints in 2025, the second-costliest cybercrime category it tracks, up from $2.77 billion in 2024, and the bureau's decade tally reached $55.5 billion in exposed losses between 2013 and 2023. The average BEC complaint now involves about $123,000, and the average wire requested in these attacks reached roughly $50,000 in late 2025, with wire-transfer attack volume up 136% quarter over quarter in Q4. These are exactly the sums that move in a typical import order: a 30% deposit on a $40,000 PO, a balance payment before a container sails.
Reported BEC losses, FBI IC3 annual reports 2020–2025. IC3 counts only reported incidents; researchers estimate actual losses run three to five times higher.
Now, the patterns themselves. Each one below is something we see, in one form or another, in the weeks between the fair and the holiday.
Pattern 1 — The bank account switch (payment diversion)
This is the most expensive scam in global trade right now, and November is its season.
How it works. An attacker gets into an email account on one side of the deal, yours or the supplier's, or registers a lookalike domain (one letter off, a dash added). Then they do nothing. They read. They learn the PI numbers, the amounts, the personalities. Microsoft incident data puts average dwell time in compromised mailboxes at around 72 hours before any visible action, and sometimes access lasts weeks. When the balance payment comes due, the buyer gets a message: "Our account is under audit / frozen / being changed, please remit to this new account." New bank. Often a new country. Same signature block, same person, same thread.
The buyer wires 30–70% of the order value to an account with no relationship to the supplier. Discovery comes days later, when the real factory asks where the money is and both sides compare inboxes to find two versions of the same conversation. By then the funds have hopped banks. The FBI's recovery program freezes fraudulent transfers at a 58–66% success rate, but only when victims report within hours. Most importers report within weeks.
Why November supercharges it. Payment volume peaks, inboxes are full of new fair-season contacts nobody has history with, and "we need the deposit this week to hold your production slot before the holiday" is both a legitimate sentence and the scam's favorite sentence. Urgency defeats verification; the AFP's payments-fraud survey found 76% of US organizations faced attempted or actual payments fraud in 2025, and the FBI's own recovery data keeps proving the same breakpoint: whether the finance person paused to verify before wiring.
The defense. One habit, non-negotiable: bank details never change by email. Any change gets verified by phone or video call on a number you already had, not one provided in the same message. Add the three-way match from our Canton Fair verification guide: the legal entity name on the business license, the contract, and the bank beneficiary must be identical, character for character, in Chinese. A beneficiary in a different city or a personal account ends the conversation until explained in writing.
Pattern 2 — The phantom pre-CNY stock offer
How it works. A "supplier" you met at the fair, or one who emails you right after it, has exactly your product, in stock or nearly, at a good price, and can ship before Chinese New Year if you move fast. The photos are real photos. Of someone else's warehouse. The stock does not exist; the deposit does. After payment, the timeline stretches, the contact thins out, and the goods never had a purchase order behind them at all.
Why November. This scam is a pure deadline parasite. It only works when the buyer is afraid of missing the pre-holiday window, which is precisely what November buyers are afraid of. In March, the same email gets ignored.
The defense. Ready stock claims are cheap to test. Ask for a live video call from the warehouse, today, with your PO number written on a sheet of paper in frame. Ask for the packing list draft. And if the order matters, send an inspector: a one-day on-site check answers "does this stock exist" definitively, for less than 1% of a typical order value.
Pattern 3 — The entity swap between quote and contract
How it works. You negotiated with a company at the fair. The quote carried their name. Then the contract arrives from a slightly different entity, and the bank account belongs to a third. Sometimes this is innocent: factories commonly export through a related trading arm for licensing and tax reasons. Sometimes it is the point of the exercise, because the entity you researched and the entity you are paying are not the same, and the one you are paying has no assets, no history, and no intention of shipping.
We can show you what this looks like from the inside, because our own audit files contain the legitimate version. In a factory audit we ran in May 2026 (report IQC-20260526-AUDIT), the very first conclusion our auditor wrote was that the company the client had been negotiating with was not the company that would produce the goods. The actual production belonged to a second, separate enterprise; the two were long-term partners, the arrangement was real, and it only became documented fact because an inspector stood in the building and compared the on-site business license against the client's paperwork. In this case the client proceeded with full knowledge. The scam version of this pattern is the same shape with the disclosure removed.
The defense. Map every legal name that touches your money: the entity you met, the entity that quotes, the entity that contracts, the entity that invoices, the entity that banks. Any new name appears, you verify it the same way you verified the first one (registry record, license, litigation history) and you get the relationship between the entities in writing. A factory audit closes the question physically: the inspector reads the license on the wall of the building where your goods would be made.
Pattern 4 — The fake or recycled inspection report
How it works. The supplier, or a party adjacent to the deal, reassures you with paperwork: an inspection report, a test certificate, a quality badge from a body you have never heard of. Some are edited PDFs from old inspections of other goods. Some come from "inspection companies" that are the supplier's cousin with a letterhead. Academic work on supplier opportunism in China treats fraudulent inspection-report submission as a documented, recurring behavior (Wang, Zhang & Huang, 2025, International Journal of Operations & Production Management), and audit fraud in Chinese supply chains has been in the literature since at least Jiang's 2009 study in the Journal of Business Ethics. A related variant: a genuine report for a different production run, recycled for yours.
Why November. Buyers are too rushed to commission their own inspection, and a ready-made report feels like a shortcut that preserves the deadline. It preserves nothing. It converts your verification budget into the supplier's marketing material.
The defense. Any inspection report you did not commission is a sales document, not evidence. If you accept third-party paperwork at all, verify the inspector: call the inspection company on a number from their official site, confirm the report number, the date, and the goods. Better: commission your own. A pre-shipment inspection you pay for answers to you; one the supplier pays for answers to the supplier. The whole structure of independent QC exists because whoever pays the inspector shapes the findings.
Pattern 5 — The new-factory price that's too good
How it works. After the fair, quotes circulate. One comes in 20–30% under the others, from a factory you did not visit, sometimes a "recommended partner" of someone you did visit. The price is the product. What is being sold is your deposit, and the manufacturing plan is a rented showroom, a borrowed business license, or nothing at all. The advance-fee factory is the oldest pattern in this market and it still works, because it targets the exact buyer the fair produces: someone comparing five quotes with no way to tell which buildings are real.
The defense. A price far below the cluster is not a finding, it is a finding-out. Verify before you celebrate: registry check (date, capital, scope, status), video walkthrough of the floor, and an on-site audit before any deposit. If the price is real, the factory survives verification and you got a deal. If it evaporates under verification, you paid $149 to learn that instead of your deposit.
Pattern 6 — The goods swap at loading time
How it works. This one happens after everything went right. Real factory, real production, passed inspection. Then, at loading: the inspected cartons are not the ones going into the container, or the quantity loaded is short, or damaged units get repacked into the batch while nobody watches. The classic version is the last-carton switch, and the quieter version is a container that leaves 10% light. You discover it at destination, weeks later, when the freight claim is nearly impossible to evidence.
Why November–December. Loading peaks with the last pre-holiday sailings, warehouses run double shifts, and supervision is at its thinnest exactly when volume is at its highest. The seasonality chart above is also a chart of when this scam has cover.
The defense. Container loading supervision: an inspector physically present while the container is loaded, counting cartons against the packing list, checking the goods match the inspected batch, photographing the seal number on the closed doors. It is the cheapest of the three standard inspection services and the one that protects the most money per dollar, because it guards the moment when your leverage is already spent.
Pattern 7 — The documentation mismatch that isn't "fraud" until it is
Not every post-fair loss is a scam. Some are non-conformities that function like one. We inspected 1,012 electric blankets in September (report IQC-20260902-BLANKET): the units themselves passed workmanship sampling and all eleven field tests, including leakage current and aging. The order still came back NOT CONFORM, because every single retail color box was dented or streaked, the product bags carried no warning labels (a compliance problem on a heated electrical product, not a cosmetic one), and the power cord's model number did not match the product model on the specification. None of that was malicious. All of it would have stranded or delisted the goods just as surely as fraud would.
In November, when everyone is rushing, these mismatches multiply: wrong shipping marks, missing labels, substituted components, spec drift between the approved sample and the batch. The line between "supplier cut a corner" and "supplier swapped a component" is thin, and from your warehouse it looks identical. The defense is the same either way: an inspection that checks the paperwork around the goods, not only the goods.
The two habits that beat all seven patterns
Strip the patterns down and every one of them exploits one of two gaps: you paid an entity you did not verify, or you trusted goods you did not see.
Habit 1 — Out-of-band payment verification. Bank changes never happen by email. Any new account, any "audit," any "urgent," gets confirmed by voice or video on a pre-existing contact. This single habit neutralizes the most expensive fraud category the FBI tracks.
Habit 2 — Eyes on the ground before money moves. Registry checks and video calls filter the list. Then, before the deposit (a factory audit) and before the balance (a pre-shipment inspection) and before the doors close (loading supervision), someone who works for you physically verifies what you are paying for. Import QC runs any of the three at a published flat $149 per man-day, anywhere in China, with the report in English within 24 hours. Against the numbers in this article (average BEC wire around $50,000, typical deposits in the five figures), verification is the cheapest line in the budget.
The fair ends. The scammers' season begins on the same calendar. Now you have theirs.
Frequently asked questions
Is fraud really worse after the Canton Fair? The fair itself is legitimate and heavily policed. What spikes afterward is the condition fraud exploits: thousands of brand-new buyer–supplier relationships wiring first deposits under pre-holiday deadline pressure. The patterns that follow the fair are the same ones seen year-round in China sourcing, concentrated into eight weeks.
What is the single most common post-fair scam? Payment diversion (business email compromise): a hacked or spoofed email tells you the supplier's bank account has changed, timed to your deposit or balance payment. The FBI logged $3.05 billion in reported BEC losses in 2025 alone, and the average wire requested is now about $50,000, exactly the size of a typical import payment.
How do I check if a supplier's inspection report is real? Contact the inspection company through its official website, not the contact details on the report, and confirm the report number, inspection date, product, and quantity. Better still, treat any report you did not commission as marketing and book your own pre-shipment inspection. Reports commissioned by the supplier answer to the supplier.
Can I verify a Chinese supplier without flying to China? Yes. Registry checks (NECIPS), three-way entity matching (license, contract, bank beneficiary), video walkthroughs, and independent reference checks are all remote. For the physical layer, a third-party factory audit replaces the flight: Import QC dispatches an inspector within 48–72 hours for $149 flat per man-day, report in English within 24 hours of the visit.
What should I do if I already wired money to a fraudulent account? Call your bank immediately and ask for a recall or freeze, then report to the FBI's IC3 (ic3.gov) if you are US-based or your local equivalent. Speed is everything: the FBI's Financial Fraud Kill Chain froze 58–66% of attempted fraudulent transfers in 2024–2025, but only for victims who reported within hours. Then verify the real supplier's account by phone on a previously known number before any replacement payment.
Are trading companies a scam? No. Disclosed trading companies can be legitimate and useful. The scam is the undisclosed one: a trader presenting as a factory, or an entity that changes between quote and contract without documentation. Verify every legal name that touches your money, and let the verification, not the booth conversation, decide who they are.
Sources
- FBI IC3, Internet Crime Report 2024 and 2025; IC3 Public Service Announcement "Business Email Compromise: The $55 Billion Scam" (Sept 2024) — BEC complaints, losses, recovery rates, decade totals
- Anti-Phishing Working Group, Phishing Activity Trends Report, Q4 2025 — average BEC wire request (~$50,297) and +136% QoQ wire-transfer attack volume
- AFP, 2026 Payments Fraud and Control Survey — 76% of organizations hit by attempted or actual payments fraud; ~74% affected by BEC
- IMF International Financial Statistics via FRED, series VALEXPCNM052N (Exports of Goods for China, monthly, NSA) — seasonality chart, 2021–2025 averages, retrieved September 2026
- Wang, Zhang & Huang (2025), "Can digitalization transform conventional governance to curb supplier opportunism in emerging markets?", International Journal of Operations & Production Management — fraudulent inspection-report submission as documented supplier opportunism
- Jiang (2009), "Implementing supplier codes of conduct in global supply chains", Journal of Business Ethics — audit fraud in Chinese supply chains
- Zhou & Xu (2012), "How foreign firms curtail local supplier opportunism in China", Journal of International Business Studies — contracts and centralized control vs opportunism
- Import QC sample reports IQC-20260526-AUDIT (factory audit, two-entity finding) and IQC-20260902-BLANKET (PSI, documentation non-conformity) — sample report library
- Related reading: Canton Fair 2026: how to verify the 40 suppliers you just met