The invoice that looks right. The supplier whose “bank details have changed”. The ATO email that arrived in BAS week. Forward it — from your phone or your inbox — and a plain-English verdict comes back before the money moves. It learns which account every supplier uses, so the change that reads perfectly still gets caught. Nothing to install, nothing to connect to your books.
False billing was the most reported scam type hitting Australian small businesses, and payment-redirection scams cost Australians $166.8 million in 2025 — up 9.3% in a year. Small and micro businesses carry most of the business losses. Sources: NASC, Targeting Scams 2025 · ASIC small business warning.
Invoice fraud arrives in two shapes. One announces itself in a sentence. The other says nothing at all, and is the one that takes the money.
That one is the loud version — the sentence gives it away, and any decent filter catches a sentence. The expensive version is quieter. Same supplier, a month later, and this time the fraudster skipped the announcement:
SAAS_LOGIN_LURE — the message names Xero; the link goes somewhere else.NEW_DOMAIN_PAYMENT — the giveaway isn't the wording, it's that the site was registered last week. Worth knowing: the real ATO never sends a link to a login page. More on ATO messages in BAS week →BANK_CONTROL_COACHINGSECRECY_INSTRUCTIONMONEY_REQUEST — and note the verdict. False billing is the most reported scam type hitting Australian small businesses, but an invoice for a listing you never ordered is often a real company using a misleading process. “You may not owe this” is the honest answer; we won't call it fraud we can't prove.These are the real replies, word for word, from the same templates the service sends. Every verdict names the pattern it matched — the full methodology, including results against third-party scam catalogues, is published at how verdicts are made.
Forward an email and the original From address is extracted from the quoted text — Gmail, Outlook or Apple Mail — and checked for one-letter lookalikes, brand-new domains and blocklist hits. That extra “t” in a fake bank domain is exactly what this exists to catch.
“Our details have changed” beside new account numbers. Being told to raise your transfer limit or split a payment — instructions no legitimate payee ever needs, because they exist to walk you around your bank's controls.
A fake Xero, MYOB or myGovID sign-in steals the password, and the mailbox is where every payment-redirection scam begins. If a message names a platform and links anywhere else, that's a scam verdict.
A genuine settlement or first invoice can look identical to fraud — so the honest answer is “be careful”, with the one instruction that works either way: ring them on a number you found yourself, and read the account details back. That call is the control that saves the money.
The most expensive invoice fraud has no scammy language at all: it comes from your real supplier's hacked mailbox, in the real thread, with only the account changed. No filter can read that from the words — but your own history can. Every invoice your team forwards teaches the service which details each supplier actually uses, and the day a regular invoice arrives with different ones, the reply leads with the fact nobody in the thread can see: these aren't the details this sender has used before — call them on a number you already have. A supplier whose details change twice in three months gets called out harder still.
Doesn't my bank already check this? Partly, and it's worth using. Since mid-2025, Australian banks' Confirmation of Payee checks that the account name you type matches the BSB and account number, at the moment you key the payment. What it can't tell you is whether that account is the one this supplier has been paid into all along — a fraudster's account opened in the supplier's own trading name comes back as a match. That's the question supplier memory answers, days earlier, the moment the invoice lands. The two catch different things; use both.
It never holds an account number to do it. What's kept is a fingerprint — a one-way code, salted separately for every business — so your supplier list can't be read, matched across customers, or leaked. An AI chatbot meets every invoice as a stranger; this has met yours forty times, and remembers none of the numbers.
Day one takes five minutes: forward one recent invoice from each regular supplier — one email per supplier — and it has learned them. After that, the memory builds itself from the invoices you were checking anyway.
And the invoice itself isn't kept. Content is checked, the verdict goes back, and the encrypted copy is deleted within 30 days, automatically — held that long only so a wrong verdict can be reviewed when you tell us about it. What persists is the fingerprint, never the document, never the numbers.
New or changed payment details on an invoice? It gets forwarded before it gets paid — every time, by whoever's paying, straight from the inbox it arrived in. Thirty seconds. Your sharpest person isn't always the one on accounts at 4pm on a Friday — and the whole point of a rule is that it doesn't need them to be.
The rule feeds the memory. The more invoices go through the check, the better it knows your suppliers — so most days, the reply is simply this:
That line is the system earning its keep on the days nothing is wrong — and the reason that on the one day something is, it knows. Protection that doesn't depend on the busiest person in the building remembering to be suspicious.
A redirected settlement isn't your client's loss story — it's your firm's professional indemnity claim. Deposit and trust-account details that differ from the ones you paid last month get the CHECK FIRST before the transfer, not after — and the callback to a number from your own file is the control your insurer wants documented. PEXA Key protects the client corridor; this covers everything else your office pays — agents, searchers, subcontracted work, the invoices that never touch a settlement platform.
Using a shared inbox like accounts@ or admin@? It can hold one of the four seats on its own, with no mobile attached, and forwards from it are recognised normally — they just all count as that one seat, rather than as whoever pressed send. Register people's own addresses where you want the answer to come back to the person who asked.
This is an automated second opinion against known scam patterns, lookalike senders and payment-redirection behaviour — it is not a guarantee, and no checker can be. A genuine first invoice and a fraudulent one can be word-for-word identical, which is why a first-time payee or changed bank details always gets the same advice whatever we detect: ring the supplier on a number you found yourself and read the account details back. That phone call is the control that saves the money; we exist to make sure you pause long enough to make it.
Got an invoice open right now? Check which bank the BSB belongs to — free, nothing stored — and see whether it matches the bank the invoice names before you ring.
PDF invoices are read directly. Forward the email and we read the attachment itself — up to eight attachments, 4MB and 20 pages each, which covers any real invoice, quote or contract. The one thing nothing can open is a password-protected PDF; if you forward one, we'll say so and read everything else, and the fix is to paste the account line or photograph the page.
Photos: send them by email or WhatsApp. Attach up to eight images to one email and we read them together, so a multi-page invoice or contract arrives as one document rather than three disconnected pictures. WhatsApp works the same way. Photos by text message are the one metered route — a few a month — because a picture over MMS costs us more than a hundred times the same picture over email. For a business, where the invoice is already in an inbox, forwarding the email is both the easiest and the least limited thing to do.
Running something bigger — a franchise group, a practice with many staff, or an institution? The partners page is for you.
Nothing to install and nothing to connect to your books. The number and the address are saved once, and whoever pays forwards straight from the inbox it arrived in.
One tap saves the number, the email and the logo. WhatsApp is the best way to send photos.