Fraudsters reply inside a real thread, from the real contact, with a real invoice number. Paste the email with its headers: see the warning signs, check the routing number's format, and get a callback script and a dated verification record for your files. It runs in your browser; nothing is uploaded.
We'll email you about early access, at most twice. No spam; reply STOP to opt out.
Guide: A supplier says their bank details changed: how to verify it before you pay
Reply-To or Return-Path that differ from the sender, lookalike domains, failed SPF, DKIM or DMARC, newly registered domains.
Who to call (the number already on file, never one in the email), what to ask, and what to write down.
A dated record of each change and how it was verified, for your Nacha fraud-monitoring procedures.
“Same thread, same sender, real invoice number.” (public r/Accounting post, Mar 2026)
“Nothing was paid but it exposed how weak our process is.” (public r/Accounting post, Sep 2026)
Had this happen recently? Tell us what happened (4 questions, about 10 minutes, no sign-up).
$149/month for 500. Includes a confirmation request sent to each supplier at the contact you already have on file. The paste-in check stays free.
We'll email you about early access, at most twice. No spam; reply STOP to opt out.