Payment-redirection fraud
The classic: a lookalike domain sends “updated” bank details at the moment money is about to move. The email looks right because the domain almost is.
Free domain security check
Is someone registering domains to impersonate you?
Business email fraud almost always starts with a lookalike domain — something that reads like you, used to slip a fake invoice or payment change into a real conversation. Enter your domain and we’ll check public records for the common impersonation patterns, and show which already exist and which can send email as you.
Quick check
Run a quick check in seconds.
Type your domain below — just the domain, like yourcompany.co.uk. This instant check looks up up to 60 of the most common impersonation patterns — lookalike spellings, missing letters and swapped domain endings — in public DNS. It’s a fast first look; for the complete picture, the free emailed report runs a far deeper scan across hundreds of variations. No sign-up, and we don’t store your domain unless you ask for the report.
Why it matters
The attack that doesn’t need to hack you.
Lookalike domains sidestep your defences entirely — they don’t break in, they just pretend to be you to someone who trusts you.
Supplier & client impersonation
It isn’t only your domain. Attackers impersonate your suppliers to you, and you to your clients — which is why monitoring the whole chain matters.
The fix is doable
Mostly process, not products: monitoring for new lookalikes, impersonation protection on your own mail, and a payment-change check your finance team actually follows. Here’s what works.
What actually helps
How to stop a lookalike costing you money.
One thing first: SPF, DKIM and DMARC don’t stop lookalike domains. They stop someone forging your exact domain, which is well worth doing — but a lookalike is a different domain that the criminal owns and authenticates properly, so its mail passes those checks. The protection comes from four other places.
Protect your customers
A lookalike of you usually targets your customers, and your security doesn’t reach their inbox. So tell them how you behave: put “we will never change our bank details by email” on your invoices and email signatures, with a number to ring. And remind them that a “no match” from their bank’s Confirmation of Payee check means stop, not click through.
Protect your own team
Turn on impersonation protection in Defender for Office 365 (part of Microsoft 365 Business Premium) for your own domains, your key suppliers and the people who approve payments — most tenants leave it on defaults. Block any lookalike you find in the Tenant Allow/Block List, and have external email that mentions bank details or sort codes carry a warning banner.
Make payments hard to redirect
Verify any change of bank details by ringing a number you already hold — never one from the email asking for the change. Two people to approve a payee change or a larger payment, and a short hold before paying a new payee for the first time. These scams depend on urgency, and a day’s delay takes it away.
Take it down, and close the gaps
Report the domain to its registrar’s abuse contact (for a .uk domain, Nominet too) and forward the emails to the NCSC at report@phishing.gov.uk. Register the obvious variants yourself and set them to refuse mail — a null MX, SPF -all and DMARC p=reject. If money has already moved, ring your bank straight away, then report it to Action Fraud.
And protect the conversation itself. The most convincing version of this attack replies inside a real email thread, which means somebody’s mailbox was read first — yours, a customer’s or a supplier’s. Phishing-resistant MFA, conditional access and an alert on new forwarding rules stop the attacker getting that timing in the first place.
Common questions
Domain impersonation, answered plainly.
Business Email Compromise — the most damaging attack on SMEs — almost always starts with a lookalike domain: something registered to read like you (or a supplier), then used to slip fake invoices or payment-change requests into a real conversation. This tool generates common impersonation variations of your domain (different endings, added words like ‘-accounts’, typos, look-alike spellings) and checks, via public DNS, which ones are registered and which have email configured.
No — and we’re careful to say so. A registered lookalike might be an unrelated business, a parked domain, or one you registered yourself defensively. What matters is the mail-capable ones: a lookalike with email set up can send messages designed to look like they come from you. Those are worth investigating, which is what the report and a conversation with us are for.
Unlike some of our other tools, this one has to send your domain to our server — DNS lookups can’t happen in your browser. But your domain (which is public information anyway) isn’t stored: we look it up and return the result. Nothing is kept unless you choose to enter your email to have the report sent to you.
It’s a fast, free sample — it checks a set of the most common impersonation patterns, not every possible variation, and it’s a point-in-time snapshot. Attackers register new domains constantly, so a clean result today isn’t a guarantee tomorrow. That’s why our managed clients get continuous monitoring that watches for new impersonation domains as they appear — it’s included as standard in the NorthMSP Standard — alongside email authentication (SPF, DKIM, DMARC) so spoofed mail gets rejected.
Block it in your own mail system first — adding the domain to Microsoft 365’s Tenant Allow/Block List takes a couple of minutes and stops anything it sends reaching your staff. Then warn the customers and suppliers it’s most likely to target, make sure your finance team verifies any bank-detail change by phone, and report the domain to its registrar and to the NCSC (report@phishing.gov.uk). After that, set up monitoring so the next one is caught early. It’s exactly the work our cybersecurity and Microsoft 365 services cover — book a free health check and we’ll look at it properly.
No, and it’s a common misunderstanding. SPF, DKIM and DMARC let receiving mail servers check that a message claiming to come from your domain really did — so they stop someone forging yourcompany.co.uk exactly, and you should have them set up. A lookalike such as yourcompany-accounts.co.uk is a different domain. The criminal owns it, publishes their own SPF, DKIM and DMARC records, and their mail passes. Your DMARC policy is never consulted. Lookalikes are stopped by impersonation protection, monitoring, takedown and a payment-change check, not by email authentication.
Found something?
Lookalike domains are only half the job.
Monitoring for new lookalikes, impersonation protection on your own mail, and a payment-change check your finance team actually follows. We’ll look at all of it properly.