Invoice fraud and supplier impersonation follow predictable patterns. The signals are there —
they just take expertise and time to spot manually. Gumshoe runs every check in seconds.
High risk
Payment redirect — business email compromise
What happens: A fraudster compromises or spoofs a real supplier's email and sends
a message: "We've updated our bank account — please use the new details for your next payment."
The email looks legitimate. The domain is one letter off from the real thing.
What Gumshoe catches: The lookalike domain was registered 11 days ago.
It has no DMARC record and no SPF policy. The web address resolves to a parked page.
Every one of those is a hard FAIL before you've read past the subject line.
WHOIS — domain age 11 days Email — no DMARC Web — parked page
Common
Shell company invoice
What happens: An ABN is registered weeks before a substantial invoice arrives
for "consulting services." The business has no web presence, uses a Gmail address,
and isn't registered for GST despite billing $15,000.
What Gumshoe catches: ABN registered 23 days ago — flagged as WARN.
No GST registration for a business claiming $15k — flagged. No website found across
five domain patterns — FAIL. Three FAIL tiles before a human has opened a second tab.
ABN — registered 23 days ago GST — not registered Web — no presence found
Common
Name collision — wrong entity, same ABN
What happens: A fraudulent invoice arrives using the name "Pacific Edge Solutions"
with a real, active ABN. But the ABN actually belongs to "Pacific Edge Solutions (Qld) Pty Ltd" —
a different legal entity in a different state, whose identity has been borrowed.
What Gumshoe catches: The ABN cross-reference shows the registered entity name
doesn't match the name on the invoice. State and entity type mismatch surfaced in the
address check. A quick check your AP team would never think to run — done automatically.
ABN — entity name mismatch Address — state mismatch
Sophisticated
Established identity, new bank details
What happens: The supplier is real, verified, and has traded with you for two years.
But their email system was compromised six months ago and you didn't know. The "updated
banking details" email came from their actual domain. The invoice looks perfect.
What Gumshoe catches: The free checks won't catch this one — this is exactly
what phone verification is for. An AI-recorded call to the supplier's listed number,
answered by an authorised person, confirms the bank change is genuine.
A$3.50 against a potential $50,000 loss.
Phone — authorised person confirms
Common
Residential address billed as commercial premises
What happens: A sole trader or micro-business lists a suburban home address as
their registered business premises. For a one-person consultancy this may be legitimate —
but for a supplier claiming large-scale manufacturing or warehousing capacity,
it's a red flag that slips through manual checks every time.
What Gumshoe catches: The Street View check sends an AI vision model to the
registered address and classifies it as commercial, residential, or vacant.
A house in a suburb billed as an industrial supplier gets flagged before the PO is raised.
Address — state/postcode cross-match Street View — commercial classification
High risk
Cancelled ABN reactivated for a single job
What happens: A fraudster locates a dormant or recently cancelled ABN — often
belonging to a defunct business with a plausible name — and presents it on invoices to
bypass basic ABN-format checks. The entity looks real until someone pulls the current
ATO status. Most accounts teams never do.
What Gumshoe catches: The ABN check pulls live status from the Australian
Business Register. Cancelled ABNs fail immediately; ABNs active for less than six months
trigger a WARN. A GST-registered entity that's never filed surfaces in the GST check.
Both tiles fail before the invoice reaches approval.
ABN — cancelled or suspended ABN — active < 6 months GST — registration status