Verify a business contact in seconds.

Short answer. Confirm the organisation exists as described, confirm the person belongs to it, and confirm any payment detail by voice on a number you already held.

Invoice fraud is where the largest single losses happen, and it rarely involves anything technically clever.

What the attack actually looks like

A supplier you know writes to say their bank details have changed.

The message quotes the right invoice number, the right project, the right people. Sometimes it comes from their real mailbox, because the mailbox was compromised weeks ago.

Or a new counterparty appears with a professional website, a plausible history and a first invoice that is unremarkable in size.

In both cases the fraud is a payment instruction, not a virus. Every control that matters sits around the payment, not around the email.

Check the organisation first

A company that exists leaves a registration. In the US that is the Secretary of State in the state of incorporation; most publish free search, with the formation date, status and registered agent.

The formation date is the single most useful field. A "twenty years in business" supplier registered four months ago has answered the question.

Check the status too. Administratively dissolved or delinquent entities keep trading and keep invoicing.

For a regulated activity — construction, medical, financial, legal — the state licence board is a second, independent register, and it publishes discipline as well as status.

For anything involving federal money or export, the exclusion and sanctions lists are public and free to search.

Then check the person

An organisation being real does not make the sender part of it.

Look for the person under their own name: professional profiles that predate this deal, filings that list them as an officer, published mentions, a court or licence record that fits the story.

A name search shows who shares the name; the records anchored to the one you choose are what make the claim more than a signature block.

Recordwell carries no email or phone data, so an address cannot be turned into a person here. The name is the input that works.

The domain tells you more than the signature

Read the sending domain character by character. A swapped letter, an "rn" reading as "m", an extra hyphen — that is the whole trick.

Watch for the real brand appearing as a subdomain of something else. A domain that ends in a stranger's name belongs to the stranger, whatever precedes it.

Check when the domain was registered. A supplier of long standing does not correspond from a domain created this quarter.

And check the reply-to separately from the from. Diverging addresses are the oldest tell in invoice fraud.

The one control that prevents the loss

Confirm every change of payment details by voice, on a number you already held — not one written in the email, not one on the new invoice.

Do it for internal requests too. "The CEO is in a meeting and needs this today" is a script, and urgency is the part that cannot survive a phone call.

Put a rule behind it rather than a habit: two people approve any change to standing payment details, and the approval happens outside the thread that requested it.

Name a threshold in that rule. Fraud is priced to sit just under whatever amount triggers attention.

Before the first payment to anyone new

Ask for the legal entity name, the registration number and the registered address, then verify those yourself rather than accepting the letterhead.

Match the bank account name to the legal entity name. A personal account behind a corporate invoice is a stop sign, not a quirk.

For a first transaction of any size, send a small amount and confirm receipt through a channel you chose before sending the rest.

Keep the verification in the file. When something goes wrong later, the question is always what was checked before the money moved.

What public records will not tell you

They will not tell you whether a real company will deliver.

Registration proves existence, not solvency; a licence proves permission, not competence; the absence of litigation proves nothing about how a contract will go.

They also cannot be used for decisions the Fair Credit Reporting Act governs. Recordwell is not a consumer reporting agency, and checking a business contact is not the same as screening an employee — that requires a provider operating under the FCRA.

If a payment has already gone

Call the bank immediately and ask for a recall. With a wire, the window is hours, not days.

Report it to the FBI at ic3.gov — its recovery process for fraudulent wires works only when the report arrives quickly — and to the FTC at ReportFraud.ftc.gov.

Tell the real supplier. If their mailbox was the record, other customers are receiving the same instruction right now.

Then check your own mailbox for forwarding rules you did not create. That is how the compromise keeps working after the password changes.

For a marketplace counterparty rather than an invoice, the seller check covers the same ground in the form that fits a one-off purchase.