The £700,000 email
It happened — April 2026TechCrunch, Apr 2026
A London-listed energy company disclosed that £700,000 left the business when the bank details on one legitimate contractor invoice were quietly changed. Professional finance staff, one email, gone before anyone noticed. UK firms lost £41.3m to invoice and mandate scams in a year.
Your version runs on an inbox. Invoices arrive by email and the bookkeeper pays them — it has worked for years. Nobody has ever checked whether your own domain can be impersonated; you can do that now, free, with our Lab email check. If a forged message sails through there, then your clients can receive “your” invoices too, with somebody else's account number at the bottom of the page.
This is you if Supplier payments start life as an email attachment; your domain fails the Lab check (most do on first run); finance and IT are the same overworked person.
How we run it
We start by watching, not enforcing.
Your domain's email authentication goes into monitoring mode, and every legitimate sender gets inventoried — the mail platform, the invoicing tool, the newsletter service. Nothing breaks on day one, because nothing is being blocked yet.
Over a month, the net tightens.
The sender rules are rebuilt properly, signing is switched on for every real source, and the weekly reports get read — so no genuine mail is being caught before we ask the world to start refusing fakes.
Then the door shuts.
Enforcement goes on, and from that point receiving servers refuse mail that pretends to come from you — before anyone has a chance to read it.
And we fix the half that technology can't reach.
One written rule for whoever pays the invoices: any change of supplier bank details is confirmed on a known phone number before the next payment leaves. We supply the page. The £700,000 above needed exactly one skipped phone call.
Made boring by: a hardening job that costs less than 2% of that one redirected invoice — or it's simply part of onboarding on Professional. Per-job at £85/h · Professional £69/user/month
Check your domain now — free, 10 seconds →
Real event: Zephyr Energy plc disclosure, Apr 2026. The firm above is illustrative.