A fake booking or payment link is the pattern to watch. Attackers read your domain. We read it first and show you what is open.
Attackers now use AI to read a clinic the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.
The rule, from its source: What does each US state's data breach law ask a business to do?
How the fraud works: Business email compromise, explained
Where an attack uses a name made from yours, the first sign is a new registration. Under the watch, LeakTrace reads the names made from yours every hour and the day's public list of new registrations each night. A name in the certificate logs is seen within minutes of its certificate being logged.
Four steps from left to right. Someone registers a name made from yours, sets up mail or a sign-in page on it, then a message or a call reaches your people and money or a code goes to them. The watch reads the first two steps. The third is your own step: a call back on a number you already have.
Step 1
A name made from yours is registered
Someone registers a domain made from your clinic's name: one letter changed, a word added or another ending.
Anyone can see: The registration record and, once a certificate is issued for it, its entry in the public certificate logs.
What LeakTrace does: Under the watch, a name that shows is dated on your record, with what it showed.
Step 2
Mail or a sign-in page is set up on it
Mail is switched on for the name, or it answers with a page that looks like your website or a sign-in page.
Anyone can see: The mail record and the page it answers with.
What LeakTrace does: LeakTrace reads its mail and its page and grades it. With the watch, or for the names the look-alike response covers, we send the takedown request in your clinic's name once you approve it. The registrar decides. Your page shows its answer once it is recorded.
Step 3
The message or the call reaches a person
An email from it reaches someone at your clinic or one of your patients. Or a caller who says they are from IT support sends someone to the sign-in page and asks for the code.
Anyone can see: Nothing. It happens inside a mailbox or on a phone.
What LeakTrace does: LeakTrace never goes inside a mailbox or a call. This is the one step only your clinic can take.
Your step: Confirm every change of payment details by a call to a number you already have. Sign in with a passkey where your mail system offers one: a code can be passed on from a fake page. A passkey cannot.
Confirm every change of payment details by a call. Any new bank details, from anyone, are confirmed by a call to a number you already have for that person. Never to a number written in the message.
Sign in with a passkey where your mail system offers one. Each person adds a passkey in their email account's security settings, on the phone or computer they use.
Step 4
The money or the code moves
Someone at your clinic acts on a supplier invoice or a payroll change and pays to new bank details, or a code passed on lets someone else sign in.
Anyone can see: Nothing, until someone notices.
What LeakTrace does: Under the watch, the name's first two steps are dated on your record: when it appeared and what it showed.
If a payment went to new details, the first call is to the bank, that day.
If a payment went to new details, call the bank that day. Call the bank's fraud line on the number printed on your card or statement, that day. Then tell the police.
Where an attack uses a name made from yours, we see it first.
Notify affected patients of a breach of unsecured health information.
Notify affected residents when certain personal information is breached. Timing and content differ.
Report a breach that creates a real risk of significant harm to the Privacy Commissioner and tell the people affected.
Tell the patient and report to the Information and Privacy Commissioner when the thresholds are met.
A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to you.
A man who laundered the money was sentenced in July 2026 in a case where a hacker got into a furniture supplier's email system, posed as its staff, changed the bank details a children's hospital system held for it, and had $5.3 million wired. About $4 million was recovered.
Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.
On monitoring: email settings every 5 minutes, new certificates for your domain and for look-alikes of your name within minutes, new look-alike registrations hourly; everything else daily, with newly exploited flaws matched to your website’s software within a day and an alert the same day. The first month of monitoring comes with the assessment.
For a physiotherapy clinic: the assessment covers what your clinic shows the public internet: its email, its website, look-alike domains and addresses at your domain in breach data. It is not a HIPAA security risk analysis and it does not look at patient records or internal systems.
What the fourth document is. A dated record of what was read from outside your clinic, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice and not a statement about your internal systems.
We close it: We give you the fix for each finding and re-check from outside until it is closed.
The one change we can make ourselves is to your email records and only when you approve each step, where your DNS host allows it.
Where it does not, you get the exact records to paste.
Your evidence pack:
It doubles as your insurance renewal evidence pack:
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own clinic's findings.
Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.
We read from outside, find each way in first and show it with a check anyone can re-run. No access, nothing tested, no obligation.
See a sample reading → An invented clinic, so you see what arrives before you ask for yours.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.