Whisker
Invoice fraud
We stop you from being tricked into paying a fake account. We set up a simple rule with your payments team to confirm every account change, practice it and leave alerts in your email so you spot the scam before it lands.
BEC protection: out-of-band verification procedure for bank detail changes, payments team training, alert rules in Microsoft 365 or Google Workspace, lookalike domain review and DMARC at reject.
- Duration
- 2 weeks
- Start
- Within 1 week
Already got a strange request to change an account? Do not pay and write to us today.
It is for you if
- You pay suppliers by bank transfer and have been asked by email to change the account.
- Several people can approve or make payments.
- You use Microsoft 365 or Google Workspace for email.
- You worry someone could pose as your supplier, your accountant or your boss.
What we do
A 45-minute training with real cases for the people who pay.Session with real BEC cases (altered invoice, fake boss, compromised supplier) and warning signs.
Alerts in your email when someone forwards messages outside or signs in from an odd place.Alert rules in Microsoft 365 or Workspace: external auto-forwarding, new inbox rules and impossible sign-ins.
We look for domains similar to yours that could be used to trick your customers.Lookalike domain sweep (dnstwist) with live DNS and MX.
We lock down your domain so no one can send email in your name.SPF, DKIM and DMARC moved to p=reject without breaking your legitimate mail.
How we work
Week 0
Scope
You tell us how you pay today and who approves.
Payment flow review and admin access to email.
Week 1
Email and domain
We set up the alerts and protect your domain.
Alert rules, SPF, DKIM and DMARC, lookalike domain sweep.
Week 2
Rule and practice
We write the rule with your team, practice it with a fake request (telling leadership first) and hand everything over.
Signed procedure, training, a fake account-change request with leadership told first, report and a 30-minute wrap-up meeting.
What you get
- The payment rule on one page, ready to keep at hand.
- Verification procedure (1 to 2 pages) signed by leadership.
- Your payments team trained and tested with a fake case.
- Training record and test result.
- Alerts working in your email.
- List of configured rules and who they notify.
- A report of what we found and what was closed.
- Report with findings (DMARC, lookalike domains, suspicious rules already in place) and final status.
Scope limits
Includes
- Up to 50 people.Up to 50 people in the company.
- 1 email domain.1 email domain on Microsoft 365 or Google Workspace.
- 1 payment flow.1 supplier payment flow.
- 1 test with a fake request.1 fake account-change request, with leadership told first.
Does not include
- We do not watch lookalike domains all year: we check them once.No continuous lookalike domain monitoring: a single run.
- We do not recover money already sent. If it already happened, see Bounce.No response to an ongoing incident or dealings with the bank: that is Bounce.
- We do not change your payment system or your bank.No changes to the ERP or online banking: we leave recommendations.
More than 50 people or several companies? Write to us and we set the scope before signing.
Questions before you buy
Does this really happen to small companies?
Yes. Nothing needs to be hacked: a believable email on payment day is enough. That is why the main defense is a rule your team always follows.
Do you need access to my email?
Admin access to set up the alerts and protect the domain. We do not read your email.
Is the fake request test meant to catch someone out?
No. It shows whether the rule works. The result belongs to the team, not to one person, and leadership knows beforehand.
Do you pay by bank transfer?
In 2 weeks we leave a practiced payment rule, alerts in your email and your domain protected.