Open proposal / payment-policy.txt

Let customers check your bank details before they pay.

A small file on your own domain says how you change bank details, where your invoices come from, and which accounts are really yours, as fingerprints rather than numbers. Anyone about to pay you, or an AI agent paying for them, can check it in a second.

Paying a supplier? Check their policy

Getting paid? Publish yours in five minutes

Who publishes one

1 domain publishes a valid payment policy. A domain appears here once any check finds its policy, and is re-checked every day. Open data (JSON)

psychevus.com: We never change our bank details by email. Treat any such email as fraud. Pinned in DNS. Since 2026-11-08.

The format (version 1)

A UTF-8 text file served over HTTPS at https://<domain>/.well-known/payment-policy.txt, at most 16 KB, without redirects. Each line is Field: value; lines starting with # are comments. Field names aren’t case-sensitive.

Version: 1
Domain: initech.com
Bank-Details-Changes: never-by-email
Invoices-From: initech.com
Invoices-From: xero.com
Account: pbkdf2:9b0e…(64 hex characters)
Verify-At: https://initech.com/payments
Contact: mailto:accounts@initech.com
Expires: 2027-11-08

Fields

Version (required, 1) and Domain (required, must equal the domain serving the file). Bank-Details-Changes: one of never-by-email, phone-callback, portal-only, in-writing-signed. Invoices-From (repeatable, up to 10): domains your invoices come from. Account (repeatable, up to 20): fingerprints. Verify-At: an https page on your domain. Contact and Expires (a date; a policy past it doesn’t count).

Fingerprints

pbkdf2: followed by 32 bytes of PBKDF2-HMAC-SHA256 (600,000 iterations) in hex. The password is the account with everything except letters and digits removed, in upper case; the salt is payment-policy:v1, a newline and the lower-case domain. The same account gives a different fingerprint on every domain. The work factor makes guessing slow, not impossible: list only accounts you already give your customers. Older sha256: lines are still read, with a warning.

Pinning in DNS

Optional: a TXT record at _payment-policy.<domain> with v=PP1; sha256=<hex of the file>. A checker compares the two and reports a mismatch. Checkers also read the _iban TXT convention (a plain SHA-256 of the IBAN) from iban-check.org.

It’s used automatically by the payment-change check. For developers and AI agents: GET /api/v1/payment-policy?domain=… and the check_payment_policy tool on the MCP server. The format is free to implement (CC BY 4.0).

Questions

What problem does payment-policy.txt solve?

When a supplier’s real mailbox is hacked, a fake “our bank details have changed” email comes from their genuine address and passes every email check. Until now nothing let a customer confirm an account except a phone call. With a payment policy, the supplier has already said, on its own domain, how it changes bank details and which accounts are really theirs.

Does it publish our bank account numbers?

Not in readable form. Each account appears as a slow fingerprint (PBKDF2-SHA256, 600,000 rounds) bound to your domain. Anyone who already has the number can check it, and a fingerprint copied to another domain doesn’t match there. It doesn’t make the number secret, though: account numbers are short, so someone who knows your bank could recover one with hours of computing per account. Only list accounts you already print on your invoices.

What if a fraudster copies the file to a lookalike domain?

It doesn’t count. A policy is only valid on the domain it names, read over HTTPS from that domain. Customers check the domain they already know, not one taken from an email.

What if someone hacks our website and edits the file?

Pin it in DNS: a TXT record named _payment-policy with the file’s hash. Changing the file without also changing your DNS then shows up as a mismatch. It still isn’t a substitute for a call: the policy makes a bank change easy to doubt, and a phone call settles it.

Is this an official standard?

Not yet. It’s an open proposal, published here with a reference checker, generator, API and MCP tool, free to implement. It reads the existing _iban DNS convention from iban-check.org too, and works alongside bank-side checks such as Verification of Payee in the EU and Confirmation of Payee in the UK.