The Three-Second Check That Prevents a Five-Figure Mistake

Most invoice fraud isn't a heist. It's a typo you were meant to trust. The classic version: an email arrives from a supplier you've paid a dozen times, asking you to update their bank details. The logo's right. The invoice number follows the sequence. Only the BSB and account number are new. In a busy accounts-payable week, that payment goes out — and the money's gone before anyone notices the real supplier never sent the email. It works because it doesn't look like fraud. It looks like admin. Three habits defuse most of it: **1. Treat any change of payment details as a verification event.** Legitimate bank-detail changes almost never arrive by email alone. Confirm by calling the number you already have on file — not the one on the new invoice. **2. Check the sender, not just the message.** A domain registered last month, an email that fails DMARC, a reply-to that doesn't match the supplier's real domain — each is a quiet tell. You don't need to be technical to see them; you need a tool that surfaces them. **3. Make verification a step, not a scramble.** The reason these checks get skipped isn't laziness — it's time. If confirming a supplier takes thirty seconds and leaves a timestamped record, it gets done. If it takes thirty minutes, it doesn't. That third point is the whole game. Verification fails not because people don't care, but because the friction is higher than the perceived risk — right up until the day it isn't. Gumshoe exists to flip that ratio: one search returns a supplier's ABN and GST status, domain age, email fraud signals, address cross-checks and a trust rating, with an assurance score and an exportable report. Most checks are free. The money you don't lose is the best kind of money there is.