How invoice email fraud actually works
Business email compromise is consistently among the most expensive fraud categories the FBI tracks, and the mechanics are mundane: an invoice or a "please update our bank details" note arrives from an address that's one character off the real supplier (john@acme-invoices.com instead of john@acme.com), or from the right name on a domain registered three weeks ago. The person paying rarely inspects the sender — the email looks like every other invoice in the inbox.
The three checks that catch most fakes
- Lookalike domain. Is the sender's domain imitating a brand or a supplier — swapped letters, added words, wrong suffix? This check compares the domain against commonly impersonated names and flags close resemblance.
- Domain age. A supplier you've worked with for years shouldn't be writing from a domain registered last month. Registration records are public; the check reads them for you.
- Mail setup. Real senders have real infrastructure: mail records, SPF, DMARC. A domain spun up for one campaign usually skips these. The check reads the domain's live DNS and shows what's configured.
Those three signals — plus the address's visible history, disposable-domain check and identity signals — make up the free check and the full report.
Keep the evidence with the payment
The $5 Trust Report is a dated PDF with a unique Report ID: the sender's history, domain record, mail configuration and overall verdict, as they stood on the day you checked. Drop it in the payment file. If a payment is ever questioned — by an auditor, an insurer, a director, or the supplier themselves — you have contemporaneous evidence that the sender was checked before the money moved.
What this doesn't replace
An email check is the fast first line, not the whole defence. If an invoice changes bank details, or the amount is significant, verify by phone using a number you already have on file — never one from the email itself. Every serious authority on BEC, from the FBI down, gives the same advice, and it stands. What this check does is catch the fakes before that call is even needed, in the thirty seconds it takes to paste an address.