A fake supplier invoice, or new bank details on a deposit, is the pattern to watch. Attackers read your domain. We read it first and show you what is open.
Attackers now use AI to read a business the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.
The rule, from its source: What does each US state's data breach law ask a business to do?
How the fraud works: Business email compromise, explained
Where an attack uses a name made from yours, the first sign is a new registration. Under the watch, LeakTrace reads the names made from yours every hour and the day's public list of new registrations each night. A name in the certificate logs is seen within minutes of its certificate being logged.
Four steps from left to right. Someone registers a name made from yours, sets up mail or a sign-in page on it, then a message or a call reaches your people and money or a code goes to them. The watch reads the first two steps. The third is your own step: a call back on a number you already have and telling your customers how you ask for payment.
Step 1
A name made from yours is registered
Someone registers a domain made from your business's name: one letter changed, a word added or another ending.
Anyone can see: The registration record and, once a certificate is issued for it, its entry in the public certificate logs.
What LeakTrace does: Under the watch, a name that shows is dated on your record, with what it showed.
Step 2
Mail or a sign-in page is set up on it
Mail is switched on for the name, or it answers with a page that looks like your website or a sign-in page.
Anyone can see: The mail record and the page it answers with.
What LeakTrace does: LeakTrace reads its mail and its page and grades it. With the watch, or for the names the look-alike response covers, we send the takedown request in your business's name once you approve it. The registrar decides. Your page shows its answer once it is recorded.
Step 3
The message or the call reaches a person
An email from it reaches someone at your business or one of your customers. Or a caller who says they are from IT support sends someone to the sign-in page and asks for the code.
Anyone can see: Nothing. It happens inside a mailbox or on a phone.
What LeakTrace does: LeakTrace never goes inside a mailbox or a call. This is the one step only your business can take.
Your step: Tell your customers that you never change payment details by email. Any such note gets a call to a number they already have. Confirm every change of payment details by a call to a number you already have. Sign in with a passkey where your mail system offers one: a code can be passed on from a fake page. A passkey cannot.
Tell your customers how you ask for payment. Put one line on the invoice footer and the first email you send: "We never change payment details by email. Call the number you already have for us."
Confirm every change of payment details by a call. Any new bank details, from anyone, are confirmed by a call to a number you already have for that person. Never to a number written in the message.
Sign in with a passkey where your mail system offers one. Each person adds a passkey in their email account's security settings, on the phone or computer they use.
Step 4
The money or the code moves
A customer sends a payment to new bank details, or someone at your business acts on a supplier invoice and pays to new bank details, or a code passed on lets someone else sign in.
Anyone can see: Nothing, until someone notices.
What LeakTrace does: Under the watch, the name's first two steps are dated on your record: when it appeared and what it showed.
If a payment went to new details, the first call is to the bank, that day.
If a payment went to new details, call the bank that day. Call the bank's fraud line on the number printed on your card or statement, that day. Then tell the police.
A current case, construction companies. Altoona Mirror, reporting Pennsylvania State Police
In June 2026 a Pennsylvania school district sent a $1.65 million payment meant for the builder renovating its high school to a thief, after an email that appeared to come from the builder changed its payment address. The district recovered the full amount, state police said in August 2026. The source does not say how the email was faked.
The source reports the last step. Our part is the first two, where a name is used.
Where an attack uses a name made from yours, we see it first.
Notify affected residents when certain personal information is breached. Timing and content differ.
Report a breach that creates a real risk of significant harm to the Privacy Commissioner and tell the people affected.
A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to you.
Police in College Station, Texas say a Florida homeowner wired $50,038 in July 2025 to someone writing as her building company, from an address and domain that were slight variations of the company's own. The arrest was reported on 1 July 2026.
A lawsuit filed in British Columbia in May 2026 says a property developer wired $1,341,478 meant for its general contractor to a fraudster in April 2026, after messages sent from a look-alike domain. Part of the money was frozen at the bank. That is a claim, not a finding.
In June 2026 the Bedford Area School District in Pennsylvania sent a $1.65 million payment meant for the builder renovating its high school to a thief, after an email that appeared to come from the builder changed its payment address. The district recovered the full amount, state police said in August 2026.
Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.
On monitoring: email settings every 5 minutes, new certificates for your domain and for look-alikes of your name within minutes, new look-alike registrations hourly; everything else daily, with newly exploited flaws matched to your website’s software within a day and an alert the same day. The first month of monitoring comes with the assessment.
What the fourth document is. A dated record of what was read from outside your business, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice and not a statement about your internal systems.
We close it: We give you the fix for each finding and re-check from outside until it is closed.
The one change we can make ourselves is to your email records and only when you approve each step, where your DNS host allows it.
Where it does not, you get the exact records to paste.
Your evidence pack:
It doubles as your insurance renewal evidence pack:
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own business's findings.
Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.
We read from outside, find each way in first and show it with a check anyone can re-run. No access, nothing tested, no obligation.
See a sample reading → An invented business, so you see what arrives before you ask for yours.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.