How to Spot a Fake Letter of Credit

What a Fake Letter of Credit Actually Is

A letter of credit is a bank's undertaking to pay a named beneficiary when stated conditions are met. A documentary credit pays the seller in a trade against a set of shipping documents. A standby letter of credit (SBLC) or a demand guarantee pays when the applicant fails to perform. In both cases the instrument's value is the bank's promise. A fake letter of credit is a document that claims that promise exists when the bank never made it, or made it for a different amount, beneficiary, or expiry.

Genuine credits rarely reach a beneficiary as a loose file. The issuing bank sends the credit through SWIFT to a correspondent in the beneficiary's country, and that advising bank passes it on. The ICC's handbook on UCP 600 explains that banks exchange authenticator keys before they can message each other, that UCP 600 article 9(b) makes the advising bank satisfy itself of the credit's apparent authenticity, and that the SWIFT network has reduced the risk of forged credits virtually altogether. SWIFT's own Category 7 standards list the MT 700 (issue of a documentary credit) and the MT 760 (issue of a demand guarantee or standby) as signed messages. That is why a PDF that arrives from the applicant, a broker, or an intermediary, with no advice from a bank the beneficiary can reach, is itself a signal.

Fake credits come in two production classes. Edited-after-creation starts with a genuine advice or a copy of a real credit and changes the amount, the beneficiary, the expiry, or the reference after the bank produced it. The bank's layout survives. Generated-from-scratch starts from a template or a screenshot of a SWIFT screen and has no issuing bank behind it.

Most fake standbys and guarantees show up outside trade, in advance-fee and investment schemes. The FBI's IC3 warning on fictitious standby letters of credit says fraud actors sell SBLCs that do not exist and use counterfeit SWIFT messages or documents labelled MT 799 or MT 760 to make them look legitimate. The same paperwork turns up as loan collateral and as proof of funds.

Inside real trade, the risk runs both ways. A fake credit can persuade a seller to ship. A real credit can be drawn with forged shipping documents. The ICC Germany white paper Shutting Fraudsters out of Trade names fraudulent documents and duplicate financing as two of the core typologies, and puts the Hin Leong collapse uncovered in March 2020, which involved both, at over USD 3.5 billion. Those same mechanics are how trade-based money laundering moves value: misstated invoices, phantom shipments, and credit instruments used to make a transfer look like commerce.

Tells That Still Work, and the Ones That Don't

The strongest tell is the channel. A credit that reached the beneficiary only as an email attachment from the applicant or a broker has skipped the step that makes a credit trustworthy. A bank letterhead and SWIFT-style field tags prove nothing, because anyone can type them.

Vocabulary still catches a large share of fakes. The Federal Reserve Bank of New York's investment scheme advisory warns about letters of credit described in unconventional ways, including credits said to be issued on ICC forms such as "ICC 3034" or "ICC 3039." No such forms exist. Credits are issued subject to rules such as UCP 600 or ISP98, not on a numbered ICC template. The Federal Reserve's 2002 supervisory letter SR 02-13 lists other phrases with no meaning in real banking: "prime bank," "top 25 world bank," "conditional SWIFT," "key tested telex," "one year and one day," and funds of "good, clean, clear and non-criminal origin."

Commercial logic is the third tell. A standby offered for lease, sale, or "monetization." A guarantee from a bank the applicant has no relationship with. A credit whose amount dwarfs the applicant's balance sheet. A fee due before anything is issued. An instrument whose terms let the holder change the beneficiary with a PIN, which is exactly what the ICC's Financial Investigation Bureau found on a fraudulent one billion euro standby it was asked to review.

A real bank's name on a forged credit clears every row that only reads the page. Only the issuer can say whether it issued the credit.

How Detection Actually Works

Detection that holds up reads the file's story before it reads the page, through six classes of signal.

Production method asks how the file was made. A credit advice printed from a bank's trade platform carries that pipeline. A file last saved in a desktop editor, rebuilt from a screenshot of a SWIFT screen, or assembled generatively carries a different one. Edited-after-creation and generated-from-scratch are separate findings, because a genuine advice can sit under a later save. Timestamp trail asks whether creation, modification, and upload cohere with the issue date and the amendment history.

Issuer matching asks whether the named bank, its BIC, its address, and its signatories match a real institution that issues this kind of instrument. Correspondent banking due diligence already holds much of what this check needs. Consistency then sets the credit against the rest of the file: the sales contract, the commercial invoice, the bill of lading, the beneficiary's account, and the applicant's real capacity. A credit that agrees with the applicant's own documents is weaker evidence than one that agrees with the bank.

Model artifacts ask whether generative or image tooling left traces a standard viewer does not show, including an image-only PDF that has flattened away the production story. Recycled patterns ask whether this reference number, wording, signatory block, or exact file has appeared in another deal. The FATF and Egmont Group's 2020 TBML report names the obvious recycling of earlier documents, with few or no edits, as a data point banks can use, and that portfolio check is the one a single reviewer cannot hold in memory.

What to Do With a Suspect File

A flagged credit is a hold, pending confirmation from the issuer through a channel the presenter does not control. Ask your own bank, or the advising bank named on the credit, to confirm receipt of an authenticated MT 700 or MT 760 with this reference, amount, beneficiary, and expiry. A bank should check its own SWIFT records, not a client's copy. Leave the phone numbers and email addresses printed on the document unused.

An unanswered confirmation request is not a pass. When the records disagree, record the specific failure: the field that changed, the save that postdates the issue date, or the BIC that belongs to a different bank. Keep the original file, keep the failed signal out of anything sent back to the presenter, and route the case to the team that handles suspicious activity, because a forged bank instrument often sits inside a larger scheme.

Read the credit alongside the rest of the packet. A fake credit often travels with a fake bank reference letter, a doctored statement, or an invoice that overstates the goods, the same pattern document fraud in banking treats across the wider file. Check a document in the Watchdoc playground before you send the confirmation request, so the x-ray is on file when the bank answers. The first file is free, and no email is required.

Where Sphinx Fits

Watchdoc scores the file and shows the x-ray: production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns. Published figures are a 94.3% correct verdict, 2.8x more forgeries caught, clean files cleared in under 28 seconds, and a review path 54% less expensive, across 1 million documents processed, at $0.45 per document with no seats and no platform fee. The Watchdoc playground runs the same check for free, with a 50-document free tier. Only the issuing bank can confirm the credit exists. Watchdoc shows whether the file in front of you has been changed.

Frequently Asked Questions