Close the way in before a forged invoice goes out in your name
A forged invoice, or a request to change bank details, arrives from an address that reads as yours. We read from outside what makes that possible at your firm, and close it before it is used: forged email where we can reach your DNS host, one click per step, the rest from the step-by-step fix you get for each finding.
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.
How a forged invoice gets sent in your name.
Words on screen, no voice. Illustrative; no real firm is shown.
Read the transcript
- Your client: Paid invoice 2217 today. Thanks! Harbourview Law LLP · Accounts: Invoice 2217, $48,200. (Illustration.)
- NOT RECEIVED. It never arrived.
- Run it back. $48,200, from Not your account back to Your client.
- From [email protected]. Subject: Invoice 2217: new bank details. It shows your real address.
- It started here. PUBLIC EMAIL RECORD: harbourview-llp.example. Rule against forged email: NONE PUBLISHED.
- 3 in 4 professional firms publish no rule against email forged in their name. Source: LeakTrace research, 2026.
- FINDING: Anyone can send email as harbourview-llp.example. The rule is set, one click per step, where we reach your DNS host and you approve it. (Illustration.)
- Harbourview Law LLP: Approved. Rule against forged email: PUBLISHED. Invoice 2217: new bank details. REFUSED.
- The AI defense layer for businesses. Your firm is being read from outside. The only question is who reads it first. getleaktrace.com
Four ways a forged payment request gets through.
On 14 October, BleepingComputer reported Organizations across 150 countries: the way in was email made to look like it came from a trusted sender.
Your SPF and DMARC records, in plain words: whether a message that fakes your address is refused or delivered.
Registered domains made from your firm’s name. We tell you which deserve a second look, with the public record behind each, and ask: is it yours?
Addresses at your domain in monitored breach databases. A reused password can open a real mailbox, and a real conversation with a client.
During the assessment your public pages are read the way someone impersonating you would read them, for posted banking details, payment instructions and who approves payments, and what is reported is human-verified.
The published figures, with their sources.
Reported losses, as the publisher states them. They describe what was reported, not what will happen to your firm.
Attackers read businesses with AI. LeakTrace reads them first. Every finding carries its evidence.
A different job from the people you already work with.
Excellent at running your systems. We read what the outside world sees and give you the exact fix for each finding, with the check that proves it. Different job, and independent: we are paid by no one who sells the fixes.
Tries to break in and needs access. We are not a pen test: nothing attacked, nothing installed, no access given. We read only what is already public, from outside, and log into nothing.
It can feed your premium and eligibility, and we do not see it. We show you what anyone can see of your firm from outside first, in plain words, so you walk into renewal knowing your own answers.
On a paid assessment, the Close AI agent handles this one: it gives you the email-record fix and re-checks from outside when you mark it done.
Where it can make the change for you, it does so only when you approve each step.
Once you mark it done, AI chooses when to re-check, and only a fresh outside read closes the finding.
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
See what a forger would see, before one uses it.
The External Exposure Check: your outside reading, the openings a stranger can see on your firm today, with the proof for the lead finding. Read-only, from outside.