Inbox check guide
Lookalike domains and invoice fraud: how to spot and stop them
Reviewed
Short answer
A lookalike domain is a near-copy of yours (yourcompany-billing.com, yourcornpany.com) registered to send convincing email. Because the fraudster sets up SPF, DKIM and DMARC for their own domain, the mail passes inbox checks and your DMARC can’t stop it. Warning signs are a recent registration and mail servers. What stops the fraud is process: payment details are never changed by email alone, and changes are confirmed by phone on a known number.
Scan for lookalikes of your domain
How the fraud works
The fraudster watches for a real invoice or payment conversation, then writes from a lookalike domain — often replying in the same thread with the display name copied — asking for payment to a “new” bank account. The message is technically legitimate email from the lookalike domain, so filters have little to object to.
Business email compromise of this kind is among the costliest online crimes reported to the FBI’s Internet Crime Complaint Center each year.
Telling a threat from noise
Many lookalikes are harmless: parked for sale, held by an unrelated business for years, or registered by you or your brand-protection provider. Three signals separate them:
- Age: a lookalike registered in the last few weeks is far more suspicious than one from 2004.
- Mail servers: a lookalike with MX records can receive replies — which is what invoice fraud needs.
- Ownership hints: the same name servers, mail servers or brand-protection registrar as your own domain usually mean it’s yours.
What to do
- Tell customers and your finance team that bank details never change by email alone, and confirm any change by phone on a number you already have.
- Block new lookalikes with mail servers in your mail filter, by domain.
- Register the closest variants yourself and publish v=spf1 -all and a DMARC p=reject record on them, so they can never send mail.
- If a lookalike is used for fraud, report it to its registrar’s abuse contact and to your national cybercrime reporting service.
- Make your real domain unforgeable too (DMARC at quarantine or reject), so fraudsters have to use lookalikes at all.