Lookalike Domains in Invoice Fraud: How to Spot Them and Get Them Taken Down
Your supplier receives an email. It looks like it came from you. It has your company name, the right tone, maybe even a copied email signature. The only thing that's different is one character in the domain. Instead of “yourcompany.com”, the email came from “yourcornpany.com”. Your supplier doesn't notice. They update their bank details as instructed. The money moves. And by the time anyone realises what happened, it's gone.
This is how lookalike domain invoice fraud works. It doesn't require a data breach or sophisticated malware. It requires a fake domain, a convincing email, and a moment of inattention.
The scale of the problem is significant. According to the Internet Crime Complaint Center, business email compromise (the category that covers this type of fraud) generated $3 billion in reported losses in 2025 alone. The lookalike domain is almost always the starting point.
What makes this particularly damaging for brands is that your company is being impersonated. Your suppliers and partners are the victims. And your reputation takes the hit.
How Invoice Fraud Uses Lookalike Domains
A lookalike domain is any domain registered to closely resemble a legitimate brand's domain. The goal is simple: trick the recipient into believing the email is coming from a trusted source.
In invoice fraud, attackers use your domain against you. They register a variation of your company's web address and use it to contact your suppliers or business partners. The email typically arrives at a convenient moment, just before a payment is due, and requests a change to banking details.
The common techniques
Attackers rely on small, easy-to-miss changes:
- Typosquatting: One swapped letter (“acmecorp.com” becomes “acmecrop.com”)
- Homoglyph substitution: A lowercase ‘l’ replaced with a capital ‘I’
- Adding a word: “acme-invoicing.com” instead of “acmecorp.com”
- TLD swapping: ‘.com’ changed to ‘.net’, ‘.co’, or a country-code extension
- Doppelganger domains: Dropping a hyphen so “acme-corp.com” becomes “acmecorp.com”
On mobile, these differences are nearly impossible to spot.
The payment redirect sequence
- The fraudster registers a lookalike domain of your company
- They identify your supplier relationships via LinkedIn or your website
- They email a known supplier, impersonating your finance team
- The email requests updated banking details ahead of a scheduled payment
- The supplier complies, and the funds go to the fraudster's account
- The fraud surfaces weeks later when the real supplier chases a missed payment
By that point, recovery is rare.
Early Detection: What to Look For
The earlier you catch a lookalike domain, the better your options. Waiting until a supplier reports a missed payment means the fraud has already succeeded.
Signs a lookalike domain may be targeting your brand
- A supplier or partner receives an unexpected email from what appears to be your company, but the domain looks slightly different
- Your brand name appears in a newly registered domain that you don't own
- You receive a bounce-back or reply to an email you never sent
- A supplier contacts you to confirm banking change instructions you didn't issue
- Monitoring tools or search results surface a website that mimics your brand identity
The most important signal is often an out-of-place banking update request. Fraudsters time these to coincide with known payment cycles. If a supplier reports receiving one from your company, treat it as a live threat immediately.
Proactive monitoring
The most effective defence is finding the domain before it's used. This means monitoring domain registrations for variations of your brand name across common TLDs and character substitutions. Remove.tech's brand protection platform monitors domain registrars 24/7, scanning for fake websites and newly registered domains that exploit your brand, so you're alerted before your suppliers are targeted.
This is the difference between reactive and proactive brand protection. By the time a supplier reports a suspicious email, the fraudster is already operational. Catching threats before they cause harm is the only approach that consistently limits financial and reputational damage.
Taking Down the Lookalike Domain
Once you've identified a lookalike domain, the objective is to get it offline as quickly as possible. The longer it stays active, the more damage it can do.
Your immediate steps
- Document everything first. Screenshot the domain, any associated website, and any emails that have been sent from it. This evidence is needed for takedown requests and, if necessary, law enforcement reports.
- Identify the registrar. A WHOIS lookup will tell you which registrar the domain is registered with and, in many cases, the hosting provider. Both can be contacted for takedown.
- File an abuse report with the registrar. Most registrars have an abuse reporting process. Submit evidence that the domain is being used to impersonate your brand and commit fraud. Include your trademark documentation where available.
- Contact the hosting provider. If the domain has an active website, the hosting provider can suspend it independently of the registrar. File a separate abuse report with them.
- Report to relevant authorities. In the UK, you can report fraud to Action Fraud. If your suppliers or partners have lost money, they should report it immediately to their bank and to law enforcement.
Why manual takedowns are slow
Registrars vary in how quickly they act, and escalating through hosting providers takes time you don't have. Remove.tech's brand protection platform handles fake website and domain removal automatically, filing takedown notices and escalating through the right channels without you having to chase each one. The hidden costs of lookalike domains extend well beyond any single fraud incident.
Informing Your Suppliers and Partners
Taking down the domain is only half the job. If fraudsters have already been in contact with your suppliers using a lookalike domain, those relationships need to be managed carefully.
What to communicate and how
- Call affected suppliers first. Do not use email to notify them of an email-based fraud. Use a number already in your records.
- Follow up in writing from your verified domain. Confirm your legitimate email address, state that a fake domain was used to impersonate you, and advise them to verify any future payment change requests by phone.
- Re-confirm your contact details. Even long-standing suppliers should check the information they hold for you.
- Give them a direct number to call. Make verification easy. A named contact and a direct line removes all friction.
Wider supply chain communication
If your supplier network is large, send a brief advisory to all active contacts. Keep it factual: a fraudulent domain was identified, it is being actioned, and any request to change banking details must be verified by phone before acting on it.
Key takeaway: One clear instruction, "always call us before changing payment details," prevents repeat incidents and signals that you take security seriously.
FAQ
What is a lookalike domain?
A web address registered to closely resemble a legitimate brand's domain, typically differing by one character, a swapped letter, an added word, or a different TLD. The purpose is to deceive recipients into believing emails or websites from the fake domain are genuine.
How do fraudsters use lookalike domains in invoice fraud?
They register a domain that looks like yours, then email your suppliers impersonating your finance team. The message requests a banking details change ahead of a scheduled payment. If the supplier complies without verifying out of band, the funds go to the fraudster.
How do I find out if someone has registered a lookalike domain of my company?
You can run manual WHOIS searches for variations of your domain, but this is easy to miss. Automated monitoring tools, such as those included in Remove.tech's brand protection platform, scan domain registrars continuously and alert you when a suspicious domain appears.
What should I do if I discover a lookalike domain?
Document it, identify the registrar via ICANN's WHOIS lookup, file an abuse report, and contact the hosting provider. Report the fraud to Action Fraud in the UK. Notify affected suppliers by phone immediately.
Does Remove.tech handle lookalike domain removal?
Yes. Remove.tech's brand protection service covers fake website and domain removal alongside ongoing domain monitoring. Their platform scans registrars 24/7 and files takedown notices automatically when infringing domains are identified.
If your brand is being impersonated online and you're not actively monitoring for it, the question isn't whether a lookalike domain exists. It's whether you'll find it before your suppliers do. A free brand audit from Remove.tech takes two minutes to request and shows you what's already out there using your name..
