Invoice fraud often comes from a domain made from the firm’s own name, set up for email with no website. Your own email settings do not stop it, because it is a different domain, and it can send its first email days after it is registered. We check which ones exist for your firm and ask you one question about each: is it yours?
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.
On 14 October, The Record reported Russian-speaking victims in Brooklyn: the way in was a domain made to look like the real one.
We check for registered domains made from your firm’s name and tell you which deserve a second look.
Each one we raise comes with the public record behind it: when it was registered, whether it is set up for email, whether it has a website. For each we ask: is it yours?
A look-alike can be registered any day after your assessment. On business monitoring, the registered look-alikes are re-read every hour, and a new one reaches you within the hour.
In the paid assessment, for each look-alike worth a second look that you say is not yours we prepare a takedown request to its registrar: the abuse contact from the public registration record, the evidence, and a letter in your firm's name, prepared for you to send. You or your counsel send it.
A California appeal court decision published in May 2025 covers a $475,000 settlement payment that went to criminals. They wrote to the paying side's lawyer from a domain one letter different from the other law firm's. The court ordered the paying side to pay again.
A police affidavit reported on 7 October 2026 says a Florida couple wired a $38,805 down payment in January 2025 to someone writing as their title company. The address ended in ".co" where the company's own ends in ".com".
On 2 September 2026 the Solicitors Regulation Authority in England warned that emails misusing the name of Penningtons Manches Cooper LLP gave a client payment instructions for an invoice. They came from a domain that swapped a "q" for the "g" in the firm's own.
Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.
Measured across the firms we have assessed, not a national census. The method is in the study.
Excellent at running your systems. We read what the outside world sees and give you the exact fix for each finding, with the check that proves it. Different job, and independent: we are paid by no one who sells the fixes.
Tries to break in and needs access. We are not a pen test: nothing attacked, nothing installed, no access given. We read only what is already public, from outside, and log into nothing.
It can feed your premium and eligibility, and we do not see it. We show you what anyone can see of your firm from outside first, in plain words, so you walk into renewal knowing your own answers.
The Monitor AI agent handles this one.
On monitoring, fixed checks look for new look-alike domains every hour and follow each one until it no longer answers, and AI says when a new one is worth a takedown request.
The request is drafted for you to send only when you tell us the domain is not yours.
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
The External Exposure Check: your outside reading, the openings a stranger can see on your firm today, with the proof for the lead finding. Read-only, from outside.