Fromensics
Tamper detection
Changed after signing: what it means
When a signed email no longer matches its signature, it was changed after it was sent, or it was signed with a key you didn’t confirm. Fromensics names what changed and tells you not to pay.
What you’ll see
Changed after signing
Don’t pay. This email was changed.
Sterling Cooper signed this email, but the bank account in it isn’t the one they signed.
Call Sterling Cooper
Use a number you already have, not one from this email. If you saved the number you called when you confirmed them, it’s shown here.
Key changed
Don’t pay. This email was changed.
This email is signed with a different key from the one you confirmed for Sterling Cooper.
Call Sterling Cooper
The chip under the sender and the inbox badge say the same thing:
Changed after signing
What they signed
The report compares each part of the email with what was signed:
| Part | Result |
|---|---|
| From | Matches |
| To | Matches |
| Subject | Matches |
| Amount | Matches |
| Bank account | LT12 •••• 1000 · Not what they signed. They signed GB82 •••• 5432. |
The line under the title names the first part that changed:
- the bank account in it isn’t the one they signed
- the amount in it isn’t the one they signed
- a link in it isn’t one they signed
- the subject isn’t the one they signed
- it wasn’t signed for you
- it wasn’t signed from this address
What to do
Don’t reply to the email and don’t pay. Call the sender on a number you already have. If you saved the number you called when you first confirmed their key, the report shows it with a Call button.
Questions
Could it be a harmless change?
Mail systems sometimes reflow text. That alone shows Check before you reply, not Don’t pay. Don’t pay appears only when something the sender committed to changed: the sender, recipients, subject, links, bank details or amount, or the key itself.
Can a scammer remove the signature instead?
Yes, and then the email is unsigned. If the contact promised to change bank details only when signed, Fromensics warns you that a trusted contact asked to change where money goes without a signature.