OSINT Before You Pay a New Industrial Supplier: Spotting Look-alike Vendors and Fake Invoices

Most supplier fraud I have seen in industrial procurement is not clever hacking. It is a PDF invoice that looks exactly right, sent from a domain that is one letter off, asking for payment to a “new” bank account. Business email compromise (BEC) works because finance teams are busy and invoices are boring.

This post is a short, passive OSINT routine for the moment before you onboard a new supplier or pay a changed invoice. Everything here reads public data about a company you are about to pay. Nothing touches anyone else’s systems.

1. Start with the domain, not the PDF

The invoice is the easiest thing to fake. The domain behind it is harder.

whois supplier-example.co.id | grep -iE 'creat|registrar|status'
dig +short MX supplier-example.co.id
echo | openssl s_client -servername supplier-example.co.id -connect supplier-example.co.id:443 2>/dev/null \
  | openssl x509 -noout -subject -issuer -enddate

What to look for:

• Registration age. A supplier claiming fifteen years of trading on a domain registered last month deserves questions.
• Look-alike spelling. Swapped letters, added hyphens, .com instead of .co.id. Put the invoice domain and the domain in your vendor master file side by side and read them character by character.
• Mail exchangers. If the website domain and the invoice domain have completely unrelated mail setups, find out why.

A TLS certificate proves nothing about identity. Free certificates are issued to anyone who controls a domain.

2. Check whether the domain resists spoofing

SPF, DKIM and DMARC are public DNS records. They do not prove a company is honest, but they show whether someone can easily send mail pretending to be them.

dig +short TXT supplier-example.co.id | grep -i spf
dig +short TXT _dmarc.supplier-example.co.id

A DMARC policy of p=reject or p=quarantine makes direct spoofing harder. p=none or no record at all means you should be extra careful with any mail that claims to be from that domain — and that a look-alike or compromised mailbox is still possible either way.

3. Use what the supplier publishes about itself

Legitimate B2B suppliers want to be onboarded, so they make vendor registration easy. That gives you a reference point that does not come from the email in front of you.

As a concrete example, the industrial and PPE supplier Avenix (PT Avenix Ventura Indonesia, Batam and Bintan) has a dedicated vendor documents page at avenix.id/en/vendor-documents . The company profile PDF is a free public download. The legal set — business ID (NIB) and deed of establishment, tax ID (NPWP), VAT registration (SPPKP), a company bank details letter and distributor appointment letters — is not published. You request it through the official WhatsApp or email channels listed on the site, and availability is confirmed in the reply. The page also lists the company data in a copy-ready form for vendor registration.

That pattern is what you want from any supplier:

• Public: who they are, where they are, how to contact them.
• On request, through official channels: bank and tax documents.
• Never: bank details that only exist inside an unsolicited email.

When an invoice arrives, compare its sender domain, legal name and contact details against what the official site says. Mismatches are cheap to find and expensive to ignore.

4. The bank account check that actually stops fraud

Every BEC playbook ends the same way: the bank details change. Controls that work:

1. Account holder name must match the legal entity. A company invoice paid to a personal account is a stop.
2. Bank changes are verified by call-back, using a phone number from your own vendor master file or the supplier’s official website. Never use a number printed on the email asking for the change.
3. Two people approve any change to supplier bank details in your ERP or accounting system.
4. First payment to a new account is small, confirmed received by the supplier through a known channel, then the balance follows.

5. Log what you checked

Write a short record for each new supplier: the domain checks, the DMARC result, where the documents came from and who confirmed the bank account. If something goes wrong later, that record is what your bank, auditor and insurer will ask for first.

supplier: <legal name>
domain: <domain>  registered: <date>  dmarc: <policy>
documents: requested via <official channel>, received <date>
bank account: verified by call-back to <number from own records>, <name>, <date>

Summary

Domain age and spelling, mail authentication, documents from official channels, and call-back verification of bank details. None of this needs an exploit or a paid tool — a Kali shell and ten minutes per supplier are enough to stop the most common invoice fraud in procurement.