An invoice with new bank details is the pattern to watch. Attackers read your domain. We read it first and show you what is open.
Attackers now use AI to read a business the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.
The rule, from its source: What does each US state's data breach law ask a business to do?
How the fraud works: Business email compromise, explained
Up to 350 look-alike addresses an attacker could register from your name, checked on each assessment.
75 techniques attackers use against businesses like yours, each checked externally on every assessment.
16 routes to your money, your clients, your accounts and your name, checked end to end on each assessment.
Attackers run AI agents in swarms: many at once, each trying the combinations of these routes against any business it can read. We read for the combinations first.
Everything LeakTrace reads about a business, area by area, with what the business receives and what we never do: Capabilities
Where an attack uses a look-alike address an attacker registered from your name, the first sign is the registration. Under the watch, LeakTrace reads the look-alike addresses an attacker could register from your name every hour and the day's public list of new registrations each night.
Four steps from left to right. Someone registers a look-alike address from your name, sets up mail or a sign-in page on it, then a message or a call reaches your people and money or a code goes to them. The watch reads the first two steps. The third is your own step: a call back on a number you already have and telling your customers how you ask for payment.
Step 1
A look-alike address is registered
Someone registers a domain made from your company's name: one letter changed, a word added or another ending.
Anyone can see: The registration record and, once a certificate is issued for it, its entry in the public certificate logs.
What LeakTrace does: Under the watch, a name that shows is dated on your record, with what it showed.
Step 2
Mail or a sign-in page is set up on it
Mail is switched on for the name, or it answers with a page that looks like your website or a sign-in page.
Anyone can see: The mail record and the page it answers with.
What LeakTrace does: LeakTrace reads its mail and its page and grades it. With the watch, or for the names the look-alike response covers, we send the takedown request in your company's name once you approve it. The registrar decides. Your page shows its answer once it is recorded.
Step 3
The message or the call reaches a person
An email from it reaches someone at your company or one of your customers. Or a caller who says they are from IT support sends someone to the sign-in page and asks for the code.
Anyone can see: Nothing. It happens inside a mailbox or on a phone.
What LeakTrace does: LeakTrace never goes inside a mailbox or a call. This is the one step only your company can take.
Your step: Tell your customers that you never change payment details by email. Any such note gets a call to a number they already have. Confirm every change of payment details by a call to a number you already have. Sign in with a passkey where your mail system offers one: a code can be passed on from a fake page. A passkey cannot.
Tell your customers how you ask for payment. Put one line on the invoice footer and the first email you send: "We never change payment details by email. Call the number you already have for us."
Confirm every change of payment details by a call. Any new bank details, from anyone, are confirmed by a call to a number you already have for that person. Never to a number written in the message.
Sign in with a passkey where your mail system offers one. Each person adds a passkey in their email account's security settings, on the phone or computer they use.
Step 4
The money or the code moves
A customer sends the money for an invoice to new bank details, or someone at your company makes a supplier payment to new bank details, or a code passed on lets someone else sign in.
Anyone can see: Nothing, until someone notices.
What LeakTrace does: Under the watch, the name's first two steps are dated on your record: when it appeared and what it showed.
If a payment went to new details, the first call is to the bank, that day.
If a payment went to new details, call the bank that day. Call the bank's fraud line on the number printed on your card or statement, that day. Then tell the police.
A current case, manufacturers and wholesalers. IRS Criminal Investigation, release of 8 Oct 2026, on a sentencing in the Southern District of Texas
A federal prosecutor in Texas announced a sentence on 8 October 2026 in an email scheme that ran from 2020 to 2022. Fraudsters sent emails that appeared to come from known suppliers. A utility trailer company in Mississippi wired $927,080 it believed was going to its trailer supplier. The source does not say how the email was faked.
The source reports the last step. Our part is the first two, where a name is used.
Where an attack uses a look-alike address an attacker registered from your name, we see it first.
Notify affected residents when certain personal information is breached. Timing and content differ.
Report a breach that creates a real risk of significant harm to the Privacy Commissioner and tell the people affected.
A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to you.
A lawsuit filed in Manitoba in May 2026 says a Quebec packaging manufacturer wired $203,664 after an email that appeared to come from its insurance broker. The claim says the address ended in "-ca.com" where the broker's ends in ".ca". That is a claim, not a finding.
A federal prosecutor in Texas announced a sentence on 8 October 2026 in an email scheme that ran from 2020 to 2022. Fraudsters sent emails that appeared to come from known suppliers. A utility trailer company in Mississippi wired $927,080 it believed was going to its trailer supplier.
A federal prosecutor in Ohio announced a guilty plea on 28 September 2026 in a case from June 2020. A New Jersey health-care provider received emails that claimed to come from its safety-equipment supplier and paid about $1.1 million to a new bank account.
Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.
The first month of monitoring comes with the assessment.
What the fourth document is. A dated record of what was read externally, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice and not a statement about your internal systems.
We close it: We give you the fix for each finding and re-check externally until it is closed.
The one change we can make ourselves is to your email records and only when you approve each step, where your DNS host allows it.
Where it does not, you get the exact records to paste.
Your evidence pack:
It doubles as your insurance renewal evidence pack:
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own business's findings.
Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. They change nothing by themselves: you approve each change to your email records.
We read externally, find each way in first and show it with a check anyone can re-run. No access, nothing tested, no obligation.
See a sample reading → An invented business, so you see what arrives before you ask for yours.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.