← Back to home Features

Is this email really from your supplier?

ScamShield AI checks whether an email is really from your supplier, and returns a verdict in under 3 seconds. It scans inbound business email for spoofed senders, supplier BEC and fake tax notices. Connect Gmail (Zoho Mail and Microsoft 365 coming soon), or paste a single email.

By Darshil Thummar, MSc Information Security & Digital Forensics · CTO, ScamShield AI
Start free trial

A supplier you have paid for years emails a fresh invoice with “our bank account has changed, please use the new NEFT details.” The domain looks right. The signature looks right. The money goes to a fraudster. Business email compromise and phishing are now among the costliest email threats facing Indian SMEs, because a single convincing message can redirect a real payment, and most inboxes let it straight through.

ScamShield AI reads the things a busy accounts team misses. It scores every incoming email against 14 India fraud categories, catches the spoofed domain, the changed bank account and the urgency pressure, and raises an alert.

How to tell a spoofed supplier email from a real one

Domain & sender spoofing

Spoofed sender domains and lookalike addresses that are one character off the real thing, plus display-name spoofing where the name reads correctly but the underlying address does not, are flagged before you reply.

Supplier BEC & payment-change fraud

Forged supplier emails that change the NEFT or bank account in a payment instruction are flagged. On Gmail (Zoho Mail coming soon), the email is scored as high risk when the new account differs from the one we have seen that supplier use.

Fake tax & government notices

Fake GST notices, forged income-tax demands and other government impersonation emails that pressure you into paying a penalty or clicking a link are matched against known India fraud patterns.

Malicious links & credential phishing

Credential-phishing links that mimic banks, wallets and portals to steal a login are checked, so a staff member never hands over a password on a fake sign-in page.

What the check tells you about the sender

How does ScamShield AI check a supplier email?

Illustrative example of the engine’s output on a forged supplier invoice email.

HIGH RISK · 88/100Category: Supplier BEC (CAT-10)
  • The sender domain is a lookalike of your real supplier, one character off the genuine address.
  • The email changes the NEFT bank account in the payment instruction to a new, unverified account.
  • There is urgency pressure to pay today, a classic tactic to rush the transfer before anyone checks.
✓ Verdict in < 3 seconds ✓ Email body not stored when scanned

How to check a supplier email before you reply or pay

1

Connect Gmail or paste an email

Connect Gmail in a few clicks (Zoho Mail and Microsoft 365 coming soon), or simply paste a suspicious email into the scanner. No IT team, no mail server changes.

2

Every email is scored automatically

The ScamShield AI model reads each incoming email against 14 India fraud categories in real time, checking sender, domain, links and payment details.

3

Get an alert before you act

Threat alerts arrive by email and in your dashboard with a risk score, the fraud category and a plain-English reason, before you reply or release a payment.

Questions about spoofed senders and supplier email fraud

How does ScamShield AI catch a spoofed supplier email?

It reads every inbound email against 14 India fraud categories. It flags display-name spoofing and urgency pressure to pay today. On Gmail (Zoho Mail coming soon) it also flags a sender domain that is a lookalike of a supplier you have added as a trusted vendor (often one character off), and a payment instruction that moves to a bank account different from the one we have seen that supplier use. When these signals stack up, the email is scored as high risk with a plain-English reason, so your accounts team sees the danger before releasing a payment. A verdict returns in under 3 seconds.

Do you store my emails?

Not when we scan them. In line with India’s DPDP Act 2023, the email body is processed in memory and is never written to the database during scanning. For a flagged message, we keep the sender's full email address and the subject line for 90 days so you can locate it. After that, only the sender's domain is kept and the subject line is removed. An alert about a change to a supplier's payment details that has not yet been acknowledged is kept in full until it is acknowledged, and for no longer than 12 months. The only exception is an email you choose to report: it is kept inside that cybercrime evidence pack for up to 12 months (24 if you extend it for an ongoing case), then deleted.

Which mailboxes can I connect?

You can connect Gmail today; Zoho Mail and Microsoft 365 are coming soon. Once connected, incoming email is scanned automatically. Mail from domains you have marked as trusted, and on Gmail mail you send yourself, is skipped. The changed-bank-account and lookalike-supplier checks run on Gmail (Zoho Mail coming soon). If you prefer not to connect a mailbox, you can also paste a suspicious email into the scanner for a one-off check.

Which plans include the phishing email scanner?

The phishing email scanner is available on both the Starter and Professional plans. Start with a 30-day free trial. No card required.

Stop a fake invoice before you pay it.

Connect your mailbox or paste any suspicious email free during your trial. Verdict in seconds.

Start free trialBook a demo
✓ 30-day free trial ✓ ₹1 verification, auto-refunded ✓ Servers in India
More checks
Invoice fraud check →GST notice checker →GSTIN checker →GSTIN-PAN consistency check →