Field note · 2026-10-15 · DME Computer Services
How to spot invoice fraud and business email compromise
Invoice fraud is a payment instruction you did not mean to follow. Sometimes the From address is a lookalike. Sometimes it is your real domain, sent from a mailbox someone else opened. The bank details are the part you verify out of band.
The FBI's Internet Crime Complaint Center describes business email compromise as a scam aimed at people who make real transfers of funds. The public service announcement dated 11 September 2024 (I-091124-PSA) says it is frequently done by compromising a legitimate business or personal mailbox, through social engineering or by breaking into the account, and then requesting a transfer. A lookalike domain is one version. A real mailbox is the other.
What the message tends to ask for
A vendor, or someone who looks like your vendor, says the bank account on file is closed and gives a new one. Or a manager, or someone who looks like a manager, asks for a wire and asks you not to call. Or payroll receives a change of direct deposit. The display name is familiar. The useful check is the full email address, which the IC3 note says to make visible, including on phones that hide it behind a name.
Read the domain after the @ sign, character by character. An extra letter, a swapped pair, or a different ending is not your domain and is not fixed by your DMARC record. RFC 7489 applies to the domain that published the policy. Hover the links. A link that shows your vendor and goes somewhere else is the same class of problem.
Do not reply with a yes, and do not use the phone number in the signature. Call a number you already had: the vendor's invoice from last month, the number in your accounting file, the manager's desk. The IC3 prevention list says to use a second channel, or two-factor authentication, to verify a request to change account information. Two-factor on the mailbox matters too. It is not a substitute for the phone call about the bank account.
Three different messages, three different fixes
- The From domain is yours and dmarc=fail in the receiver's Authentication-Results header. RFC 8601 defines that header. Someone sent as you without passing SPF or DKIM in alignment. If your published policy is still p=none, the message may have been delivered anyway. The publishing order is How to set up DMARC. How to read the header is Is my email domain being spoofed?
- The From domain is yours and dmarc=pass, or the message is in your Sent folder. Your mail host sent it. That is a mailbox someone else can use, or a rule that forwards mail out. DMARC will not flag it. Lock the account, revoke the sessions, and look for a forwarding rule and a new payment template. InboxGuards is our alert for that class of takeover in Google Workspace and Microsoft 365. It does not sit in the mail path, it is not a DMARC reader, and the listing says it does not catch every incident.
- The From domain is not yours. Your DMARC record does not apply. Warn the people who pay invoices, and do not expect p=reject on your real domain to stop the cousin name.
If the money has already moved
The IC3 announcement says time matters. Contact the financial institution and request a recall of the funds. Then file at ic3.gov, whatever the amount. Banks differ in what they will do. This site cannot file that complaint for you and it cannot pull a wire back.
Tell the rest of the people who pay bills what the fake instruction looked like: the address, the new account, the story. One person catching it does not mean the next message went to them only.
What a DNS check can add
/check reads MX, SPF, DMARC, and five common DKIM selectors. It stores nothing. A missing DMARC record means you have not asked receivers to report or reject exact-domain failures. That is worth fixing. It does not prove this invoice was forged, and it does not see a lookalike domain you do not own.
The $9 report is that lookup as a PDF, with a step for each unfinished row. It requires a license key from the purchase. If checkout is not connected, the page says Coming soon. It is not a review of an invoice.
DMARC setup is DME Computer Services in Omaha publishing SPF, DKIM, and DMARC, and reading aggregate reports for 30 days. $199 is one Google or Microsoft domain. $499 is three domains or extra senders. It reduces exact-domain spoofing once the policy is no longer p=none. It does not stop a stolen mailbox or a cousin domain. Questions go to info@dmeomaha.com.
Sources
Free check · nothing stored
See the records you have now
The checker reads MX, SPF, DMARC, and five common DKIM selectors once. It does not send a message, it does not read DMARC reports, and it does not keep the domain.
From the directory
Account-takeover alerts, awareness training, and DMARC report readers. They are different jobs. The notes on each listing say which.
- CategoryDMARC, SPF, and DKIMTools that read DMARC reports or help you publish SPF, DKIM, and DMARC so other people cannot send mail as your domain.
- CategoryEmail security gatewaysFilters and monitors aimed at inbound mail: phishing, spoofing, and account takeover. Not every product here sits in the mail path. The notes say which is which.
- CategoryPhishing simulation and trainingProducts that send practice phish or train staff. A few listings here are broader security platforms that also sell awareness training.
- Tool · made by usInboxGuardsAccount-takeover alerts for Google Workspace and Microsoft 365, at $2 per active user.
- ToolKnowBe4Security awareness training, plus a free phishing simulation sandbox.
- ToolEasyDMARCDMARC monitoring with public record checkers and printed prices for the paid plans.
- ToolMXToolboxPublic DNS and mail lookups, including MX records and blacklist checks.
The other notes
- How to set up DMARC (step by step)Publish one SPF record and DKIM first. Then a DMARC record at p=none, read the reports, and only then move to quarantine and reject.
- SPF vs DKIM vs DMARC explainedSPF lists who may send. DKIM signs the message. DMARC checks that one of them matches the From address and tells receivers what to do on failure.
- Is my email domain being spoofed? How to tellRead Authentication-Results on a real message and, if you asked for them, the DMARC reports. A DNS lookup alone does not prove an attack today.
- How to set up DMARC in Microsoft 365Publish Microsoft's SPF include, copy both DKIM CNAMEs from the Defender portal, then add DMARC at p=none and move to reject only after the reports are clean.
- Google Workspace SPF/DKIM/DMARC setupAdd Google's SPF include, generate a DKIM key in the Admin console, and publish DMARC at p=none. Do not paste the strict-alignment sample on day one.
- Why are my emails going to spamA failed SPF, DKIM, or DMARC check, a complaint rate Gmail flags, or a missing PTR or TLS setup can file mail as spam. The wording is not the only cause.
- What is BIMI and do I need itBIMI is an inbox logo for mail that already passes DMARC at quarantine or reject. Gmail also wants a logo certificate. Most small domains can skip it.
Questions
Short answers to the questions this note is for. The paragraphs above are the longer version.
- The From address is our exact domain. Is the invoice fake?
- Not by that fact alone. If Authentication-Results says dmarc=pass, your mail system sent it. Look in Sent, then for a mailbox someone else can use, a new forwarding rule, and a sign-in you do not recognize. DMARC passed because the mail was yours. If it says dmarc=fail, the receiver could tell it was not authenticated as you.
- The domain is one letter off. Will our DMARC record stop it?
- No. DMARC applies to the domain in the record. A cousin name is a different registration. Your p=reject does not apply to it. Read the full address, not the display name, and warn the person who pays bills.
- They sent new bank details and said the old account is closed.
- Do not pay from the email. Call a phone number you already had for that vendor, not the number in the signature. The FBI's IC3 guidance is to verify a change of account information on a second channel. A matching logo and a familiar name are not that channel.
- Money already moved. What does the FBI say to do?
- Their 11 September 2024 public service announcement says to contact the financial institution immediately and ask for a recall, and to file a complaint at ic3.gov as soon as possible, whatever the amount. Policies differ by bank. Speed matters more than a perfect write-up.
- Will the $9 report catch this?
- No. The report is a PDF of the domain's DNS records at the moment you download it. It does not read invoices, mailboxes, or bank details. It can show that you have not given receivers a DMARC policy. It cannot show that a particular invoice was forged.