Email Verification in Gumshoe: Four Steps from Domain to Confirmed Reply

Verifying a supplier's email address is a critical step in preventing accounts payable fraud and ensuring that your organisation's payments are secure. In this article, we'll walk you through the four stages of email verification in Gumshoe and what each stage means for your supplier due diligence.

Understanding the Four Stages of Email Verification

The email verification process in Gumshoe involves four stages: domain has mail server, address accepted, opened, and replied/confirmed. Each stage provides a level of assurance that the email address is legitimate and that the supplier is who they claim to be.

Stage 1: Domain has mail server - This stage checks if the supplier's domain has a mail server configured. If the domain does not have a mail server, it may indicate that the email address is not legitimate.

Stage 2: Address accepted - This stage checks if the email address is accepted by the supplier's mail server. If the email address is not accepted, it may indicate that the email address is not valid or that the supplier's mail server is not configured correctly.

What SPF, DMARC, BIMI, and MTA-STS Records Tell You About a Supplier Domain

SPF (Sender Policy Framework), DMARC (Domain-based Message Authentication, Reporting, and Conformance), BIMI (Brand Indicators for Message Identification), and MTA-STS (Mail Transfer Agent Strict Transport Security) records provide valuable information about a supplier's domain and email configuration.

SPF records indicate which IP addresses are authorised to send email on behalf of the supplier's domain. DMARC records specify how to handle unauthenticated email and can help prevent phishing scams. BIMI records provide a way to authenticate the sender's domain and display a brand logo in the recipient's inbox. MTA-STS records ensure that email is transmitted securely using TLS encryption.

By analysing these records, you can gain insights into the supplier's email configuration and security posture.

Why Unverified Email + Changed Bank Details is the Classic Redirection Fraud Setup

Unverified email addresses and changed bank details are a common combination in redirection fraud scams. Scammers may use social engineering tactics to trick accounts payable staff into updating the supplier's bank details, only to redirect the payment to a fraudulent account.

Verifying the supplier's email address and monitoring changes to bank details are critical steps in preventing redirection fraud. By using Gumshoe's email verification feature, you can ensure that the supplier's email address is legitimate and reduce the risk of redirection fraud.

Understanding Email Verification Statuses in Gumshoe

In Gumshoe, the email verification feature checks the validity of a supplier's email address by sending a verification email to the supplier. The supplier must then click on a link in the email to confirm their email address. The email verification status is displayed in the Gumshoe dashboard, and it can have one of four statuses: PASS, WARN, FAIL, or NA. A PASS status indicates that the supplier has confirmed their email address, and it is legitimate. A WARN status indicates that the email address is not verified, but it is still possible to contact the supplier. A FAIL status indicates that the email address is not valid or the supplier has not confirmed it. An NA status indicates that the email verification feature is not applicable to the supplier.

Worked Example: Email Verification in Gumshoe

Let's consider an example of how the email verification feature works in Gumshoe. Suppose we have a supplier, XYZ Pty Ltd, with an email address [[email protected]](mailto:[email protected]). We add XYZ Pty Ltd to our Gumshoe dashboard and initiate the email verification process. The system sends a verification email to [[email protected]](mailto:[email protected]), and the supplier clicks on the link in the email to confirm their email address. The email verification status in the Gumshoe dashboard is updated to PASS, indicating that the email address is legitimate.

Email Verification Outcomes in Gumshoe

The email verification feature in Gumshoe provides several outcomes that help you assess the legitimacy of a supplier's email address. The following table summarizes the possible outcomes and their meanings:

Email Verification Outcomes in Gumshoe

Outcome	Description	Next Steps
PASS	The supplier has confirmed their email address, and it is legitimate.	No further action required.
WARN	The email address is not verified, but it is still possible to contact the supplier.	Contact the supplier to verify their email address.
FAIL	The email address is not valid or the supplier has not confirmed it.	Do not use the email address for communication.
NA	The email verification feature is not applicable to the supplier.	Use alternative methods to verify the supplier's identity.

Uncommon Insights

When verifying supplier emails, it's essential to remember that ASIC requires companies to maintain accurate records, including contact information, under Section 198 of the Corporations Act 2001. Failure to comply can result in fines of up to $12,600 for individuals and $63,000 for corporations (ASIC v Vocation Limited [2019] FCA 1617). Moreover, the Australian Taxation Office (ATO) considers email communication a legitimate means of serving notices, making email verification crucial for tax compliance. The ATO also requires businesses to keep records of all transactions, including invoices and receipts, for at least five years (ATO, Record keeping for business). Verifying supplier emails ensures that these records are accurate and reliable. In the event of a dispute, having a verified email trail can help resolve issues quickly and efficiently, potentially saving thousands of dollars in legal fees. In addition, email verification can help prevent scams and phishing attacks. According to the ACCC, Australian businesses lost over $143 million to scams in 2020 (ACCC, Targeting scams: report on scams activity 2020). By verifying supplier emails, businesses can reduce the risk of falling victim to these types of scams. ASIC's Regulatory Guide 221 (RG 221) emphasizes the importance of verifying the identity of counterparties in business transactions. Email verification is an essential step in this process, as it helps establish the authenticity of the supplier's identity and ensures that communication is secure.

Key Takeaways

• Email verification is a regulatory requirement — ASIC requires companies to maintain accurate records, including contact information, under Section 198 of the Corporations Act 2001.
• Verified emails reduce the risk of scams — email verification can help prevent scams and phishing attacks, potentially saving thousands of dollars in losses.
• Accurate records are essential for tax compliance — the ATO requires businesses to keep records of all transactions, including invoices and receipts, for at least five years.