Free tool / Before you pay
“Our bank details have changed.” Is it really them?
Fake bank-change emails are one of the costliest frauds businesses face. Enter your supplier and the address the request came from, and get a plain answer: is it them, a lookalike, or something that can’t be trusted from the email alone.
What it checks
Is it your supplier’s domain?
The sender is compared with your supplier’s real domain for every common trick: another ending, look-alike characters (including letters from other alphabets), typos, an added word or hyphen, and your supplier’s name used in front of someone else’s domain.
How new, and where do replies go?
Fraud domains are usually days old, so the registration date is read from the domain registry. A Reply-To pointing somewhere else, so that your answer reaches the fraudster, is flagged.
Could the exact address be forged?
From the full email source, it reads whether the message passed your supplier’s authentication (DMARC), and it checks whether your supplier’s domain lets forged copies through at all. Then it tells you what to do, step by step.
Questions
How can I tell if an email changing a supplier’s bank details is real?
Compare the sender’s domain, letter by letter, with the one your supplier has always used; check where replies would go; and look at whether the message passed authentication. This check does all three and adds the domain’s registration age. But no email can prove a bank change: confirm it by calling the supplier on a number you already had.
What is a lookalike domain?
A domain registered to pass for another at a glance: a different ending (initech.net for initech.com), look-alike characters (rn for m, 0 for o, or letters from another alphabet), a typo, or an extra word (initech-invoices.com). Fraudsters register them days before sending a fake invoice.
The email came from my supplier’s real address. Can I pay?
Not on the strength of the email. A large share of supplier fraud is sent from the supplier’s genuine mailbox after an attacker has taken it over, so the address and the authentication are real. Call a number you already have, and have a second person approve the change.
What if I’ve already paid the new account?
Call your bank’s fraud line immediately and ask for a recall: the sooner, the better the chance. Then report it to the police or your national fraud reporting service (in the US, the FBI’s IC3; in the UK, Action Fraud) and tell your supplier.
Is the email uploaded or stored?
No. When you paste the full email source, it’s read in your browser; only the sender and reply-to addresses and the authentication result are sent, to look up public records (DNS and domain registration). Nothing is stored.
For developers and AI assistants: GET /api/v1/payment-check?supplier=…&sender=… and the check_payment_change_request tool on the MCP server. Related: find lookalikes of your own domain · analyze any email’s headers.