Free tool · Spot fraud
Suspicious bank-change email checker
Paste an email asking you to change a supplier's bank details and see the warning signs of invoice fraud. It runs entirely in your browser — nothing you paste leaves your device.
Private by design. The check runs entirely in your browser. Nothing you paste is sent anywhere — not to Paylist, not to anyone else.
This is a heuristic check that looks for common warning signs. It can't prove an email is genuine, and it can miss fraud — especially from a supplier's real mailbox that has been hacked. Always confirm bank-detail changes by phone.
How invoice fraud emails work
Invoice fraud — also called mandate fraud or payment diversion fraud — is simple. A criminal emails you pretending to be a supplier, says their bank details have changed, and waits for your next payment to land in their account. By the time the real supplier chases the unpaid invoice, the money has usually been moved on.
The emails come from one of three places. Some come from a lookalike domain registered to resemble your supplier's (examp1e-supplies.co.uk instead of example-supplies.co.uk). Some use a genuine-looking address but quietly set the Reply-To to somewhere else, so your answer goes to the fraudster. The hardest to spot come from your supplier's real mailbox after it has been hacked — the criminal has read the thread, knows the invoice numbers and writes in the right tone.
What this checker looks for
Fraud emails follow a script, because the script works. The checker looks for its common lines:
- A request to change bank details, or to pay a different account “just this once”.
- An excuse for the change: an audit, an account “under review”, a new bank.
- Time pressure: urgent, today, before close of business, overdue.
- Anything that stops you checking: “our phones are down”, “please don't call”, “reply by email only”, “keep this confidential”.
- A warning that the account name won't match — so you ignore your bank's Confirmation of Payee alert.
- Bank details written in the email itself.
If you paste the headers too, it checks who really sent the email: whether replies go to a different domain, whether the display name hides a different address, whether it came from a free personal account, and whether the sender's domain is a lookalike of your supplier's or of a domain mentioned in the email's own signature.
How to see the headers
Most mail apps hide the full headers. In Outlook, open the message and choose File → Properties (desktop) or the three dots → View → View message details (web). In Gmail, open the three dots menu and choose Show original. In Apple Mail, choose View → Message → All Headers. You only need the From, Reply-To, Return-Path and Subject lines, but pasting the lot does no harm.
What it can't tell you
This is a heuristic check, not a verdict. It can't see whether an email passed SPF, DKIM or DMARC checks, and it can't tell a hacked genuine mailbox from the real thing — a well-written email from your supplier's own account can show no warning signs at all. A low result means we didn't spot the usual tricks, not that the email is safe.
That's why the advice never changes, whatever the result: don't use any contact details from the email itself, and phone the supplier on a number you already hold before you change anything. Ask for someone you've dealt with before. If the change is genuine, it will survive a five-minute call.
Taking email out of the loop
Every check on this page exists because bank details travel by email, where anyone who can send or alter a message can change them. Paylist removes that step: suppliers list their bank details once in a verified directory, and you look them up before you pay instead of trusting whatever arrived in your inbox.
Frequently asked questions
What does an invoice fraud email look like?
Usually a short, polite message from what looks like a supplier, saying their bank details have changed and asking you to pay the next invoice to a new account. It often adds a reason (a new bank, an audit), some urgency, and something that discourages you from calling — “our phones are down” or “please reply by email”.
How do I know if an email is really from my supplier?
You can't be sure from the email alone — even a perfect-looking message can come from a hacked mailbox. Check the sender's domain and Reply-To address carefully, then phone the supplier on a number you already hold (not one from the email) and ask them to confirm the change.
Is it safe to paste an email into this checker?
Yes. The check runs entirely in your browser using JavaScript on this page. Nothing you paste is uploaded, stored or sent to Paylist or anyone else — the tool doesn't even make DNS lookups.
What should I do if a supplier emails new bank details?
Don't reply to the email and don't use any phone number in it. Call the supplier on a number from an earlier invoice, your contract or their website, speak to someone you know, and confirm the new sort code and account number with them before updating your records or paying.
What if I've already paid a fraudster?
Call your bank immediately — use the number on your card or statement. Banks can sometimes freeze or recover funds if they act quickly. Then report it to Action Fraud (or Police Scotland on 101 if you're in Scotland) and let the genuine supplier know.
Why does the checker say low risk when I think the email is fake?
It looks for common patterns, and not every fraud email uses them. Emails sent from a supplier's real, hacked mailbox often look entirely normal. Trust your instincts — if anything feels off, confirm by phone before paying.
What is a Reply-To mismatch?
An email can say it's from one address but send your reply to another. Fraudsters use this so the From line looks like your supplier while your answers go to them. If the Reply-To domain differs from the From domain on a payment email, treat it as suspicious.
Check before you pay — every time
Paylist is a verified directory of UK business bank details. Your suppliers list theirs once, and you look them up instead of trusting an email.