Vendor Impersonation
The email says it's your vendor. The domain says otherwise.
Fake-invoice and BEC fraud almost always starts with a lookalike of a supplier's domain. We watch every vendor domain you pay and flag the lookalikes before your AP team sees them.
How the fraud works
1. Register
A criminal registers acmepayments-billing.com.
2. Email
They send "our bank details have changed" to your AP team.
3. Pay
You pay the criminal.
VendorBreach catches step 1.
What we detect
- Typosquats and character swaps
- Homoglyphs (rn vs m, 0 vs o)
- TLD swaps (.co, .net, .ca)
- Added words (-billing, -invoice, -payments)
- Subdomain tricks
What makes a lookalike dangerous
Each finding shows the risk factors that apply:
- Can send email (MX / SPF)
- Live website
- Recent registration
- Privacy-protected registrant
- Certificate issued
- On a phishing or malware blocklist
Built for finance as well as security
- Optional AP-team alert recipients
- One-click "add to mail-gateway block list" export
- A short "verify before you pay" checklist PDF
Score impact: an active, mail-capable lookalike of a vendor raises that vendor's risk until it's taken down or confirmed harmless.
Frequently asked questions
Catch the fake-invoice domain before the invoice.
14-day free trial. No credit card. Nothing to install.