Scammers pose as your suppliers and ask you to pay a new bank account. Paste the email to see the warning signs, then create the verification record your bank or insurer can ask for. Free, no signup, nothing saved.
Fill in the blanks after your call, then print it or save it as a PDF.
Limits: an email sent from a supplier's real mailbox after it was hacked can pass every check above. The call-back in section 3 is the step that catches it.
Hello,
Please note that our bank details have changed. Due to an ongoing audit, our previous account can no longer receive payments, so do not send anything to the old account.
Kindly update your records and remit all outstanding invoices to the new account below by Friday:
Routing number: •••••1234
Account number: ••••••3391
I am in meetings all day, so please reply by email to confirm once updated.
| Date | Supplier | Request | Outcome | Called by | Approved by |
|---|---|---|---|---|---|
| Oct 5 | Brightwater Supply Co. | New bank account | Blocked: not sent by supplier | AP clerk | Owner |
| Sep 18 | Cedar Lane Print Co. | New bank account | Confirmed by call-back | AP clerk | Owner |
| Aug 30 | Mesa Ridge Freight | New vendor setup | Confirmed by call-back | Bookkeeper | Owner |
Preview of Kheru for Outlook, which is in development. Companies and entries are made up. The free check above uses the same engine.
In development. The free check works one email at a time; the add-in will check every supplier email as it arrives.
We'll email you once, when it's ready to try. Bookkeepers: tell us and we'll set you up for your clients.
Banks and insurers ask whether you have a written process for payment-detail changes. Fill in three details and print a one-page procedure your team can sign and follow.
Review it, adjust anything that doesn't fit how you work, then print it.
This procedure applies to every request to add or change the bank or payment details of a supplier, contractor, employee or anyone else we pay, however the request arrives: email, phone, letter or a supplier portal.
Nacha writes the rules for ACH, the US bank-transfer network. Since June 22, 2026, every business that sends ACH payments through its bank needs a risk-based process to spot payments made under false pretenses, such as a scammer posing as a supplier. It applies at any size, and the process must be reviewed every year.
| A solid process | How this page helps |
|---|---|
| A written procedure for payment-detail changes | The procedure generator gives you a one-page version to adopt and sign. |
| Screen every request to change where money goes | The free check flags lookalike and new domains, failed sender checks, scam wording and bad account numbers. The add-in will do it automatically. |
| Confirm through a channel you already trust | The record walks you through the call-back to a number you already had, and where that number came from. |
| A second person approves the change | The record has a separate approver and signature line. |
| Keep evidence of each change | The verification record, printed or saved as a PDF. The add-in will keep them as a log. |
| Review the process at least once a year | The procedure sets a review date. The add-in's log will show every change for the year. |
Plain summary, not legal advice; ask your bank what it expects. If a payroll or bill-pay provider sends payments for you, ask them how they handle it. Source: Nacha, Fraud Monitoring Phase 2.
The email itself, public domain records, and your own mail server's verdict on who sent it.
Your mail server's SPF, DKIM and DMARC results, read from the email's headers. A fail means it didn't come from the domain it shows.
Compares the sender's domain with your supplier's: swapped, missing or extra letters, look-alike characters such as “rn” for “m”, added words and different endings. Without your supplier's domain, we use the company name in the email.
When the sender's domain was registered, from its registry. Fake supplier domains are often days old.
Requests to change bank details, the reasons scammers give (an audit, a frozen account), pressure to pay fast and attempts to keep you off the phone.
Whether a US routing number or an IBAN is valid, which Federal Reserve district a routing number belongs to, and crypto wallet addresses. Shown masked.
Links that show one address but go to another, links to new or lookalike domains, and web-page or program attachments.
Whether your reply would go to a different domain from the one the email shows.
Gmail, Outlook.com, Yahoo and others, where anyone can open an address using any company's name.
The scammer registers a domain one letter away from your supplier's, often days before, and sends “new bank details” from it.
The scammer gets into your supplier's email and sends the change from their real address, often inside an existing thread. Only a phone call catches this.
The email shows your supplier's name, but replies go to an address the scammer controls, so your questions reach them.
The original includes the headers, where your mail server recorded who really sent it. Copy all of it and paste it into the box above.
Open the email, select More (⋮) > Show original, then Copy to clipboard.
Open the email, select the three dots (…) next to Reply, then View > View message source (or View message details). Copy all the text.
Open the email in its own window, then File > Properties. Copy the Internet headers box, paste it above, then paste the message text under it.
Open the email, then View > Message > Raw Source. Select all and copy.
On a phone, mail apps don't show the original. Paste the message text or the sender's address, or check from a computer. If you forwarded the email to yourself, paste the original if you can: a forward hides the first sender's checks. Check emails you received, not copies from your Sent folder, which have no sender checks to read.
Yes. There's no signup. You can run up to 30 checks a day from one network, and the samples don't count. The verification record and the written procedure are free too.
It records what they usually ask about a payment-detail change: how the request was screened, the call-back to a number you already had and where that number came from, who confirmed it, and who approved the change. Requirements differ, so ask your bank or insurer whether they need anything more, and keep the signed copy with the supplier's file.
No. We read the email in memory to run the checks and discard it once the result is sent back. We look up the domains in it: the sender's, the company it names and up to three link domains. Like any lookup on this site, public results such as registration dates and DNS records are cached for up to an hour. The verification record and the procedure are created in your browser and aren't sent to us.
The headers hold your own mail server's verdict on who really sent the email, and the text shows what it asks you to do and where the money would go. With only an address we can check the domain, but not whether the email was faked.
Not necessarily. If your supplier's real mailbox was hacked, the email comes from their real domain and passes every check here. Always confirm a bank change by calling your supplier on a number you already have.
A domain made to look like your supplier's at a glance: an extra or missing letter, two letters swapped, "rn" in place of "m", an added word such as "-billing", or a different ending such as .co instead of .com.
Scammers usually register a lookalike domain shortly before they use it. A domain registered days ago that claims to belong to a supplier you've paid for years is a strong warning sign.
Checks that let mail servers confirm an email really came from the domain it shows. If the headers show the email failed DMARC, it did not come from the domain it claims. Paste the full original email to see these results.
If your business sends ACH payments through its bank, it does: there is no small-business exemption. If a payroll or bill-pay provider sends the payments for you, ask that provider how it complies. This is a plain summary, not legal advice; your bank can tell you what it expects.
It will check supplier emails inside Outlook and Gmail as they arrive, remember your real suppliers' domains, phone numbers and accounts, and keep the verification record for every change in a log you can export. It isn't available yet. Join the waitlist and we'll email you once when it's ready to try.
