Verify blog · November 12, 2026 · 2 min read
How to spot a fake invoice or a "new bank details" email
A supplier you pay every month emails to say their bank has changed. The logo is right, the invoice looks normal, the amount is what you expected. Sometimes it's real. When it isn't, the money is usually gone by the time anyone notices.
How it works
The scammer either gets into the supplier's mailbox or registers an address that looks almost the same, like acme-suppply.com instead of acme-supply.com. Then they send a real-looking invoice or a short note saying the bank details have changed. Everything is normal except where the money goes.
The signs
- The sender's domain is one letter off, has an extra word, or uses a different ending (.co instead of .com)
- Replies go to a different address than the one it came from
- A company name sent from a free mailbox like Gmail or Outlook
- The domain was registered days ago
- It asks you to keep it quiet, or to pay today
- It asks for a wire, gift cards or cryptocurrency
The one habit that stops it
Before you pay a new account or change a supplier's bank details, call them on a phone number you already had, not one in the email. It takes two minutes, and it works even when the email itself is perfect.
Where Verify helps
Paste the email or forward it to Verify, and it checks the sender, the reply address and every link. Add the suppliers you pay to your trusted list, and a lookalike of any of them is the first thing the result tells you.
If you've been targeted, report it to the Canadian Anti-Fraud Centre, and call your bank straight away if money was sent.
Common questions
Can Verify tell me an email is safe?
No checker can. A new scam can show no warning signs, so the best answer is "no warning signs found". If an email asks for money or a password, confirm another way.
Do you keep the emails I check?
No. The email is checked in memory and thrown away. Only the result is kept, for 90 days, and you can delete it any time.