Check an invoice's payment details before you pay it
Many payments lost to fraud are not hacks. They are an invoice, or an email beside it, saying the vendor has new bank details. Put what you have on file for the vendor beside what the new invoice says, and paste the message that came with it. The page shows what changed, a sender or a wallet made to look like the vendor's, an IBAN or routing number that cannot be right, and the words such requests use. Then it writes the call to make before you pay.
Fill in what you have: a detail is compared when both sides are filled. The check runs in this page, and nothing you type is kept. This page may count the visit and a click on Try it on your bills, by its address. What you paste or type is never sent. OFAC's SDN list as of Oct 28, 2026.
On file means what you had before this invoice: your accounting software, your bank's saved payee, or a past invoice you paid. Never copy it from the email this invoice came with.
On file: from your recordsOn this invoice
Vendor name
Email it came from
Phone
IBAN
Account number
Routing or sort code
SWIFT / BIC
Bank name
Wallet address
The email, or the invoice's note. It is read for the words requests to change payment details use. If you can, paste its From and Reply-To lines too (Gmail: Show original; Outlook: View source).
How it works
- An IBAN, account number, routing or sort code or wallet that differs from the one on file is a reason to stop and call before you pay. So is one the invoice gives when none of the ways to be paid on file is on it. Beside one that matches, a new one is one to look at. A name, phone number, bank or SWIFT / BIC code that differs is one to look at, unless a new SWIFT / BIC moves an account number with no IBAN to another bank.
- The sender's domain is compared with the vendor's. One that looks like it is a stop: the same name under another ending, a word or a hyphen added, a letter or two changed, or letters that look alike, such as rn for m or l for i, and so is a domain in another alphabet. At a free mail service such as Gmail, the whole address is compared. A sender's name that is another email address is a stop. Any other domain is one to look at, and an invoice sent through a service such as Xero or QuickBooks is named as such.
- An IBAN is checked for its country's length and its check digits, a US routing number for its check digit, and a SWIFT / BIC code for its form. One that fails cannot be right as written: check what you typed, then ask the vendor. A detail on file that cannot be read is said too, so it never hides a change.
- A wallet gets the address checker's rules: hidden characters, its checksum, OFAC's list, and whether it is made to look like the one on file, the trick called address poisoning.
- The message is read for a request to change how you pay, and a Reply-To on another domain. Beside a change, it also points out pressure to pay quickly, a request not to call or to keep it quiet, and the reasons such requests give.
- The call script names what changed, tells you to call the number on file, never one from the invoice, and to let the vendor read the details out to you.
What it does not do
- It does not know who holds an account, a wallet or a domain, and looks nothing up: no bank, no domain records, no ENS. Nothing found means these checks found nothing, not that the invoice is the vendor's. A vendor's own mailbox can be broken into, so an email from the right domain can still ask for the wrong account.
- Your bank's payee name check, such as Confirmation of Payee in the UK, does know who holds an account: if it says the name does not match, do not pay.
- It does not read the invoice's file: type or paste its details.
- It keeps nothing between visits. For one wallet against the ones you know, use the address lookalike checker; for a vendor's name against OFAC's list, the OFAC vendor check.
What Vestiarion does when payment details change
Vestiarion holds every payment to a payee whose address changed until a person confirms the new address; with the payee lock on, that takes a recorded check on a contact you had before. Once a workspace pays for real, it emails the payee's billing address on file to ask whether they made the change, and a payout to a bank account waits for a person every time. It is an AI agent for bills and payments, and every step is signed into a ledger anyone can check.
In shadow mode it decides on your real bills while you keep paying them as you do now.