Counterparty Check.

Guides

Stopping vendor bank-change fraud (BEC) in AI agent payments

Vendor bank-change fraud, a form of business email compromise (BEC), is when someone imitating a real vendor asks for payment to new bank details. To stop an AI agent from falling for it, call POST https://counterpartycheck.com/v1/check before paying and pass what the agent knows: the vendor's domain on file (known_good_domain), whether the bank details changed (bank_details_changed), how the change was requested (change_requested_via), whether there's urgency (requested_urgency), and the details used last time (previous_payment).

The pattern it looks for

  1. New payment details: a different routing number, IBAN or wallet from the previous payment.
  2. Delivered by email: the change came in an email, not through a channel you already trust.
  3. Urgency: pressure to pay today.
  4. A sender domain that imitates the vendor: acme-supp1y.com or acmesupply.co instead of acmesupply.com, sometimes newly registered or not registered at all.

Any one of these is worth noting; together they are the textbook pattern, and the check returns block.

Example

POST https://counterpartycheck.com/v1/check
{
  "counterparty": { "name": "Acme Supply Co", "country": "US", "email": "ar@acme-supp1y.com" },
  "payment": { "method": "ach", "routing_number": "021000021", "amount": 48000, "currency": "USD" },
  "context": {
    "known_good_domain": "acmesupply.com",
    "bank_details_changed": true,
    "change_requested_via": "email",
    "requested_urgency": true
  }
}

What the agent should do on a block

Don't pay, and don't use any contact details from the suspicious message. The fix is out-of-band confirmation: a person calls the vendor at a phone number from your own records. The response's recommended_action says this in plain English so the agent can pass it on.

Frequently asked questions

How can an AI agent detect business email compromise?

By checking each payment request before paying: Counterparty Check flags changed bank details requested by email, urgency, and sender domains that imitate the vendor's real domain.

What is a lookalike domain?

A domain built to be mistaken for a real one, using swapped characters (1 for l), extra words, hyphens or a different ending like .co instead of .com.

What should happen after a block verdict?

Do not pay, and have a person confirm the change by calling the vendor at a number from your own records.

Read the docs Pricing