Is this “our bank details have changed” email real?
The fraud usually arrives in a real thread, from the real contact, with a real invoice number. Paste the whole email, headers included: we look for the signs that give it away, and give you the callback script and a dated record for your file.
Want suppliers to confirm changes themselves, at the contact you already have?
We're setting this up by hand for a few AP teams: each change request goes to the supplier's contact on file (not the email that asked), they confirm or deny on a short page, and you get the record. Ask to try it.
Had a fake change request, caught or not? Tell us what happened (4 questions, written, no call).
What it checks, and what it can't
- Headers: Reply-To and display-name tricks, the bounce address, and the SPF, DKIM and DMARC results your own mail server recorded.
- Domains: look-alikes of the supplier's usual domain (swapped letters, rn/m, 1/l, other endings), registration date, and whether the domain can be spoofed (no enforced DMARC).
- Wording: the usual script: new details, urgency, a reason (audit, switched banks), “don't call”.
- Bank details: the routing number's ABA checksum or the IBAN's check digits. Format only.
- Can't: tell whether the supplier's real mailbox was hacked (then everything above can look clean), or who owns the account. Only a callback to a number you already had, or your bank's account validation, can. Not legal or security advice.
Built by Hieu Tran with AI agents. Not affiliated with any bank, Nacha or AP software vendor.