Invoice Fraud Checker — Spot Fake Vendor Emails & BEC Scams
Paste a suspicious invoice email to check it for business email compromise red flags — before you pay. Free, private, no sign-up.
Triage, not a verdict: this tool flags known BEC patterns so you can pause and verify. A "low signals" result never guarantees safety — always confirm payment changes through a known phone number.
What is invoice fraud and business email compromise?
Business email compromise (BEC) is fraud where attackers impersonate a vendor, supplier, or executive over email to redirect payments. The most common pattern is brutally simple: an email that looks like it's from your real supplier asks you to send the next invoice payment to "new" bank details — which belong to the criminal. Sometimes they spoof the address with a lookalike domain; sometimes they take over the supplier's real inbox and reply inside an existing thread. The FBI's IC3 2025 Internet Crime Report recorded 24,768 BEC complaints with about $3.05 billion in reported losses, and small businesses are hit hardest — roughly 73% of BEC attacks target SMBs, with a median loss near $50,000.
Why this checker exists
Most BEC victims are not careless — they are busy. The fake email arrives right before a payment is due, references a real invoice number, and uses the supplier's name and signature. Generic scam checkers look for PayPal or parcel-delivery phishing; almost nothing free focuses on the vendor-payment scenario that costs businesses the most. This tool fills that gap: paste the email, and it checks for the specific red flags of invoice fraud — bank-detail-change requests, typosquat domains, reply-to mismatches, urgency and secrecy language, and pressure to bypass your normal approval process.
How to use it
Paste the suspicious email into the box — including the From line and headers if you can copy them. Optionally enter your vendor's real domain (for example, acme.com) so the tool can spot lookalike domains. Tick any context boxes that apply, then press "Analyze for fraud signals". You will get a plain-English risk level — HIGH RISK, CAUTION, or LOW SIGNALS — plus an explanation of every flag found and a step-by-step checklist of what to do next. You can print the report as a PDF for your records.
If you already paid a suspicious invoice
Act within hours, not days. Call your bank's fraud department immediately and ask whether the transfer can be recalled or reversed — the FBI's Financial Fraud Kill Chain recovers funds most often when reported within 24 to 72 hours. Then report it: in the US file at ic3.gov, in Pakistan report to FIA Cybercrime. Tell the real vendor their name is being impersonated, and preserve the email, invoice, and payment records as evidence.
Honest limitations
This tool analyzes the email's text and structure — it never contacts any server, which keeps your data private but means it cannot verify whether a domain was registered yesterday or whether an invoice number is real. A careful attacker can write a clean-looking email with no obvious flags. No checker catches everything, which is why the tool never declares an email "safe": treat every unexpected payment request as guilty until verified through a phone number you already trust.