Check an email or website before you pay
Before you send a deposit, completion money or an invoice payment, paste the sender’s email address or website. You get facts about the domain and things to check, then confirm the bank details by phone.
Whatever this shows, confirm bank details by phone on a number you already have, not one from the email. A hacked mailbox at a genuine firm passes every check here.
Breach data: Have I Been Pwned, CC BY 4.0.
What this checks
- Email address format: whether the address is written correctly.
- Email set-up: whether the domain can receive email (MX records).
- Free or disposable email: whether the address uses a free provider such as Gmail or Outlook, or a domain on a public list of temporary email services.
- Domain age: when the domain was registered, from the registry’s public record. Not shown for .uk domains.
- Spoofing protection: a short summary of the domain’s DMARC and SPF settings. Full detail is in our email security checker.
- Company number: whether the website’s home page shows a UK company number, with a link to its Companies House record.
- Known data breaches: whether the website’s service appears in the Have I Been Pwned catalogue of breached services (licensed under CC BY 4.0).
Before you send money: 4 steps
- Never act on new bank details sent by email. Phone the firm on a number from their website, your contract or an earlier letter, not from the email.
- Check the payee name. When your bank shows a Confirmation of Payee result, read it. A “no match” or “close match” is a reason to stop and call.
- Send a small test amount first if you are paying a large sum, and confirm by phone that it arrived.
- If you think you have paid a fraudster, call your bank straight away, then report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 (in Scotland, Police Scotland on 101).
More detail: how to check a bank account before paying and payment diversion fraud in property sales. You can also check an IBAN’s format with our IBAN checker.
How to read your results
We show facts and mark some as “worth checking”. We never call a business or a person genuine, safe or a scam.
| What you see | What to do |
|---|---|
| Domain registered recently | Compare it with the domain the firm used earlier in your conversation. Many new businesses are genuine. |
| Domain differs from earlier emails | Look at every character. Call the firm on a number you already have. |
| Free email provider for a firm | Ask the firm, by phone, whether this address is theirs. |
| On the disposable email list | Don’t pay on instructions from this address without phoning the firm. |
| No DMARC policy, or p=none | Anyone can send email that looks like it comes from this domain. Treat a change of bank details by email with extra care. |
| No company number on the website | Ask for it, then check it on Companies House. Sole traders and partnerships don’t have one. |
| No warning signs found | This doesn’t mean the email is genuine. Still confirm bank details by phone. |
Limits of this check
This is a quick check of public records about a domain. It is not identity verification or customer due diligence, and it cannot tell you who sent an email or whether a person or business is honest.
- A genuine firm’s hacked mailbox passes every check. Fraudsters who get into a real mailbox send email from the real domain.
- We don’t read or test the mailbox. We look at the domain’s public DNS and registry records and its home page only.
- Lists are not perfect. The disposable email list can include domains that are no longer disposable, and miss new ones.
- Breach data is about the service, not the person. We don’t check whether a particular email address was in a breach.
- We only read the home page for a company number. Some firms show it on another page.
Second opinion: Get Safe Online runs a free website checker.
Check before you pay: questions
Can this tool tell me if an email is a scam?
No. It shows facts about the sender’s domain, such as its age, email set-up and company number, and lists things worth checking. It cannot see who sent the email. A fraudster using a genuine firm’s hacked mailbox would pass every check, so always confirm bank details by phone on a number you already have.
What should I do if my solicitor or agent emails new bank details?
Do not pay. Call the firm on a number from their website, your paperwork or an earlier letter, not the number in the email, and ask them to confirm the details. Genuine firms expect this call. Many tell clients at the start that they will never change bank details by email.
Why does domain age matter?
Fraudsters often register a new domain that looks like a real firm’s a few days or weeks before they use it. A recently registered domain is a common warning sign, not proof of fraud, because genuine new businesses also have new domains. Compare it with the domain the firm used earlier in your conversation.
Why don’t you show the age of .uk domains?
The .uk registry’s terms don’t allow its registration data to be re-used without permission, so we don’t display it. You can look up a .uk domain yourself on Nominet’s lookup service. For other endings, such as .com, we show the registration date from the registry’s public record.
What is Confirmation of Payee?
Confirmation of Payee is a name check your bank runs when you set up a new payee. It tells you whether the name you typed matches the account: a match, a close match with the actual name, no match, or unable to check. Pay.UK says it is not a guarantee that a fraudulent payment will be caught.
What if I have already sent money?
Call your bank immediately using the number on your card or statement. Under the UK reimbursement rules for bank transfers, individuals, micro-enterprises and charities can claim up to £85,000 if they report within 13 months, unless they were complicit or grossly negligent. Then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
Do you keep the email address or website I check?
No. We look up public records about the domain while you wait, keep the domain result in a short cache for up to an hour, and do not save what you entered or who checked it. Have I Been Pwned is only asked about breaches of the website’s service, never about your address.
Are you an estate agent, conveyancer or accountant?
For your own AML checks, AML Buddy sends your client one secure link and gives you a timestamped PDF report. £5.40 a check inc. VAT (£4.50 + VAT), 5 free checks to start, no subscription.