Fromensics
Invoice fraud
Check an invoice email before you pay
Invoice fraud changes one detail in an email that looks normal: the sender’s address, the bank account, or the amount. Fromensics reads the email you choose, in your browser, and answers with what to do.
What you’ll see
Don’t pay
Don’t pay this invoice.
It came from sterlingcooper-partners.com, not Sterling Cooper’s usual address, and it asks you to pay an account Sterling Cooper hasn’t used before.
Ask Sterling Cooper to confirm
We’ll write to accounts@sterlingcooper.com, the address you already have.
Don’t pay
Don’t pay this invoice.
Report phishing in Gmail
Uses Gmail’s own report button. The sender isn’t told.
Check first
Check before you reply.
Jordan says they’re from Brightline Media but writes from brightline-media.example, which doesn’t match that name. We haven’t checked how new that domain is.
Check onceAlways check
We’ll look up when it was registered and how its mail is set up. Only the domain name is sent, never the email.
Nothing looks off
Nothing looks off.
The checks that ran found nothing wrong, and it doesn’t ask for money or a login.
Add Alice to trusted senders
We’ll warn you if someone ever imitates this address.
What it asks
When an email asks for money, the report lists what it wants in four rows, read from the email text in code:
- Pay
- £12,480.00
- For
- Invoice 1048
- To
- LT12 •••• 1000Not an account Sterling Cooper has used before · Lithuania
- By
- Today
The account number is masked. The country comes from the IBAN itself, and only when its checksum is valid. By shows a deadline the email names, like “today”, “by Friday” or “within 24 hours”. Whether a contact has used the account before comes from signed emails you’ve received from them, never from the email’s own wording. More on this in bank details changes.
How Fromensics decides
- Who sent it: lookalikes of your trusted senders or of your own address, a company name the address doesn’t match, look-alike characters and known brands. See lookalike addresses.
- What it asks: money, a change of bank details, pressure to act now, or a password.
- Where it points: links and redirects, and matches on the Fromensics threat list.
- Signatures: if the sender signs with Fromensics, whether the bank account and amount are the ones they signed. See changed after signing.
Rules in code decide the answer, so the same email always gets the same one. Every reason is listed under How we know, and checks that couldn’t run are listed as not checked.
Before you pay any invoice
- Confirm a new bank account on a phone number you already have, not one from the email.
- Reply to the address you already have for the supplier. Fromensics drafts that email for you.
- Be wary of deadlines. “Today” is the most common one in invoice fraud.
Questions
Does Fromensics upload my invoices?
No. The subject, body, recipients and attachment names are read in your browser. Fromensics only goes online when you choose Check once or turn on automatic checks, and then it sends one domain name, never the email.
Can it tell me who owns a bank account?
No. Fromensics can’t tell who owns an account. It can tell you whether a trusted contact has used that account in signed emails before. Confirm anything new on a number you already have.
Does it scan my whole inbox?
No. It checks one email when you click Check sender, press Alt+Shift+F, or paste something into Check anything.