ProofRelayIs this invoice a scam?
If a supplier has emailed you new bank details, or an invoice doesn't feel right, paste it below. You'll get a plain-English answer in about a second — what we found, why it matters, and exactly what to say when you pick up the phone.
Australian businesses reported $84 million lost to payment-redirection scams in a single year, and the average business victim loses tens of thousands in one transfer. Almost all of it is stopped by one phone call to a number the email didn't give you.
The three questions people ask
Questions
Does anything I paste get uploaded?
No. The entire check runs as JavaScript inside your own browser — there is no upload, no server call, no database write, and no logging of what you paste. You can disconnect from the internet after this page loads and it still works. That is deliberate: the documents people most need to check are the ones they are least willing to send to a stranger.
What exactly does it check?
The ABN's checksum (a fabricated ABN fails the ATO's algorithm), IBAN check digits and country for overseas accounts, whether a SWIFT/BIC code agrees with the IBAN's country, Australian BSB and account patterns, every email domain in the text, and the urgency, secrecy and procedure-bypass language that appears in nearly every one of these frauds. If you tell it the supplier's real domain, it also compares the sender against it character by character — catching 'rn' for 'm', an inserted hyphen, or the same name under a different ending.
Why won't it just tell me the invoice is safe?
Because it cannot know, and a tool that says 'safe' when it cannot know is worse than no tool. The most damaging version of this fraud comes from the supplier's own real mailbox, after a criminal has broken into it. The domain is genuine, the invoice template is genuine, the thread history is genuine — only the bank account is wrong. No amount of text analysis catches that. A phone call to a number you already had does.
Is this only for Australian businesses?
The ABN and BSB checks are Australian. Everything else — IBAN and BIC validation, the lookalike-domain comparison, and the pressure-language analysis — works anywhere. The advice at the end is the same in every country.
I think I've already paid a scammer. What do I do?
Call your bank immediately and ask them to attempt a recall — the first few hours matter more than anything else you will do. Then report it: in Australia, ReportCyber (cyber.gov.au) and Scamwatch; elsewhere, your national cybercrime reporting service. Keep the original email with its full headers intact, and tell the real supplier, because their mailbox may be the one that was broken into.
Read next
- Is this invoice a scam? Seven checks before you pay
The seven things worth checking on an invoice that doesn't feel right, and the one check that actually settles it.
- A supplier emailed new bank details. What should you do?
The single most common way businesses lose large sums — and a short, repeatable process that stops it.
- You've paid a scammer. What to do in the first hour
If money has already gone, speed decides the outcome. The order of operations that gives you the best chance.
- How to stop invoice fraud in a small business
A practical checklist across email, process, banking and people — with an honest note about which items matter most.
- What is business email compromise?
The plain-English explanation of the attack, the five shapes it takes, and why technology alone doesn't stop it.
- How to verify a supplier's bank details properly
The verification most businesses do is the one that fails. Here's how to do it so it actually catches fraud.
- Who pays when invoice fraud happens?
The question everyone asks after the money has gone, and the uncomfortable answer most businesses discover too late.
- Settlement fraud: why conveyancing is the top target
Large, time-pressured, irreversible: why property settlements attract the most determined attacks, and what actually holds.
- Payment fraud in strata management
Owners' money, constant contractor invoices, and one person approving them — the combination attackers look for.
- Subcontractor payment fraud in construction
Legitimate bank-detail changes are normal in construction — which is exactly what makes the fraudulent ones work.
Checking one invoice is good. Never having to remember is better.
This page can only look at what you paste. ProofRelay remembers every bank account you have verified, flags the ones you already rejected, spots the same account appearing under two different suppliers, and makes it impossible for the person who received the email to be the one who approves the payment. Free for teams of up to three.
Set up your organisation free