How to verify a supplier email before you pay or sign
By the Vanguard Verify desk · Published 2026-10-26 · Updated 2026-10-26
Short answer: to verify a supplier email, confirm that the sending domain is the company's real domain, that the domain is not a lookalike or recently registered, and that the message passes authentication checks. Most important of all, confirm any bank details or payment instructions by phone, using a number you found independently and not the one in the email. The FBI describes business email compromise (BEC) as a scheme in which criminals spoof or compromise email accounts to redirect payments.
Step-by-step check
- Find the company's real domain independently. Use the company's official website and its registry entry. You can confirm the legal name and address through its LEI record. See how to check an LEI number. Then compare that domain to the sender's.
- Compare the domain letter by letter. Look for swapped letters (rn for m), extra hyphens, a different ending (.co instead of .com) or the company name used as a subdomain of another domain.
- Check when the domain was registered. Use the ICANN Lookup tool. A domain created a few weeks ago for a company claiming decades of trading needs an explanation.
- Read the authentication results. In your email client, open "show original" or the message headers and find the SPF, DKIM and DMARC results. A "fail" on mail claiming to be from a large company is a warning sign. A "pass" only proves the mail came from that domain, not that the domain belongs to the real company.
- Check the Reply-To address. If replies go to a different address from the sender's, find out why.
- Call to confirm any payment instruction. Use a phone number from the official website or registry, never the one in the email. Do this every time bank details change.
- Check the beneficiary. The account holder name should match the contracting company. Ask your bank to check the beneficiary bank's BIC. See how to verify a SWIFT BIC code.
Red flags
- A late change of bank details, especially just before a deposit or a balance payment is due.
- A new bank account in a country where the supplier has no operations, or in the name of a different company or an individual.
- Urgency or secrecy: "pay today or lose the cargo" or "do not discuss with your bank".
- A large producer writing from free webmail.
- Documents such as FCOs, SPAs or invoices sent as editable files or with mismatched letterheads.
- The person refuses a video call or a call through the company's main switchboard.
What each check proves
| Check | Proves | Does not prove |
|---|---|---|
| SPF/DKIM/DMARC pass | The mail was sent by the domain shown | That the domain belongs to the real company |
| Domain age | How long the domain has existed | That the company is legitimate |
| Registry/LEI record | That the legal entity exists | That the sender works there |
| Independent callback | The instruction is confirmed by the company | That the product exists |
If you think you have been targeted
Contact your bank immediately and ask it to try a recall of the payment. Report the incident to the police or the national cybercrime authority. In the United States this is the FBI's Internet Crime Complaint Center (IC3). For the wider supplier check, see how to verify a commodity supplier.
Check a company now with Vanguard Verify — first check free.
Type the company name. We show its public registry record (Global LEI Index), free.
Public registry data. By searching you accept our Terms.
FAQ
Can I verify an email address belongs to a company?
Check that the domain matches the company's official website and registry details, check the domain age with ICANN Lookup, and confirm by calling a number found independently.
Does DMARC pass mean the email is safe?
No. It shows the mail came from the domain shown. A fraudster can pass DMARC on a lookalike domain they own.
What should I do if a supplier changes bank details by email?
Do not pay until you have confirmed the change by phone, using a number from the company's official website or registry.
Where do I report business email compromise?
Tell your bank first, then report to the police or the national cybercrime authority. In the US, report to the FBI's IC3.
Vanguard Verify is run by Vanguard Trade Capital Goods Wholesalers DWC-LLC, Dubai South, Licence 14282. This answer is general information, not legal or financial advice.