Stop fake invoices sent from a web address like yours
Criminals register a domain like yourcompany-invoices.com and email your customers new bank details (business email compromise, or BEC). We find those domains and get them taken down. We watch lookalikes of your key suppliers' domains too.
We watch for the lookalike domain a criminal has to register before the first fake invoice can be sent.
The example email here follows our fake-invoice case: a lookalike of a products company's domain, set up only to send email, told its trade customers, as a named salesperson, that payments had moved to a new “factoring” company.
What one fake invoice costs you
Your customer pays the criminal
Then they chase you for the goods, or refuse to pay twice. Either way, you are left sorting out a loss you did not cause.
Customers start to doubt your invoices
After one fake invoice, customers may phone to confirm every bank detail, or hold payments until they are sure. Your cash comes in later.
Hi Sarah,
Further to our call last week, please note that we have moved our receivables to a new factoring arrangement. All previous remittance instructions are now void.
Invoice INV-20418 ($125,000.00, due 28th) should not be settled to the account on the original invoice. Please reply to this email and I will send over the verified banking details for the new account today.
Kind regards,
Karen Mitchell
Sales Director, Your Company Inc
- Registered today
- Set up to send email, no website
- Uses your company name
Your real domain is yourcompany.com
The company, domain, people and figures in this example are made up.
How fake bank details get sent
There are three common routes. We cover the third, and check your own settings for the second.
Fake invoice schemes we find
Who in your company this helps
In a small firm this is one person. In a larger one, finance hears about the fake domain and IT deals with it.
Owners and finance directors
Warned when someone can send invoices in your name
You hear when a lookalike of your domain is set up to send email, with what it is and what to do next.
Accounts and office managers
Know which emails to doubt
When a lookalike of your domain appears, you can warn customers and check bank changes by phone before money moves.
IT and security
The evidence is collected for you
Each alert arrives with its evidence pack, so there is nothing to look up before you act on it.
IT providers and MSPs
All your clients in one login
Partners manage many client companies from one login; alerts can go to the partner’s own staff.
Looking after several companies as an IT provider? See the partner programme
Where payment checks fall short
Callbacks, two approvers and a trained finance team all help. Each one still relies on someone spotting that the email came from the wrong address.
How we find a fake invoice domain and get it taken down
Give us your domains. There is nothing to install.
Step 1
We list the likely fakes
Around 500 per domain that a criminal is most likely to use: typos, your name plus a word such as -invoices or -payments, letters that look alike, other endings such as .co or .net, and names built from your registered company name, such as yourcompany-ltd.com.
Step 2
We re-check them every hour
When one is registered, gets a website or is set up to send email, it is flagged on your watch list; if it looks set up to attack you, you get an alert. Email with no website is the usual fake-invoice set-up: there is no page for a host to remove, so most tools never notice it.
Step 3
You confirm, we report it
If it is used against you, you confirm it is a live attack with one click. We send the evidence to up to 12 places at once, including the registrar, the host, the email provider it sends through and the spam blocklists. In our fake-invoice case, it went to ten.
Step 4
We follow up and keep watching
If nobody acts, we chase the host and registrar at 48 and 96 hours, then the registry at 120 and 168 hours. We tell you when it goes offline, or after 30 days if it has stalled, and keep watching after the takedown in case it comes back.
What an alert shows your team
Each alert says what we found, why it matters and what to do next. It comes with the evidence pack: screenshots, who registered the domain, where it is hosted and who handles its email, each with the time it was captured.
If you approve the takedown, the evidence goes to:
Set up to send email, no website
- RegistrarSent
- Email provider it sends throughSent
- Abuse-report networkSent
- Spam blocklistSent
- Host and abuse database, if it points at a serverSent
- Browser warning listsSkipped: no website
- Phishing feedSkipped: no website
- Malware feedSkipped: no malware
- Search enginesSkipped: no website
No report goes to a registrar, host or blocklist until you confirm.
Alerts arrive by email, or in Slack, Microsoft Teams, SMS or a webhook. IT teams can also send them to Splunk, Microsoft Sentinel or Wazuh.
What our fake-invoice case looked like
Case study, mid-2026
Fake invoice domain taken offline
An established e-commerce and wholesale products company that sells to trade customers and online. Afterwards, its customers were told to confirm any change of bank details by phone, on a number they already had.
Read the case study- Lookalike set up to send email, no website
- Same dayOn anti-phishing blocklists, which cut delivery of its emails
- Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
- LaterThe attacker added another email platform. We reported that too.
- The registrar took the domain offline
From the case. Names changed.
Questions finance teams ask
See what we would find for your domains
In a 30-minute demo we show you the lookalikes of your domain that exist today and how an alert would reach your team.
- Which lookalikes of your domain are registered now, and which can send email
- Who on your side would read the alerts, and what they would do
- A clear annual price, with your key suppliers included if you want them covered
Rather see results first? Run a free scan