How it works

What happens when you run an analysis.

PaySentinel isn't a black box. Here's exactly what the tool does with what you submit, what it checks, how the risk score is built, and what to do with the result.

You submit a payment request for analysis

You paste in details about a payment you're about to make — or one that looks suspicious. Depending on what you have, you might submit a vendor name and email, a routing and account number, an invoice, or the text of a suspicious email.

🏢

Vendor check

Name, email domain, routing number, account number

🧾

Invoice check

Invoice details or PDF upload — fields extracted automatically

📧

Email check

Sender, subject, and body text of a suspicious email

🔗

Link check

A URL from an email or document you want to verify

Each element is checked against known fraud signals

PaySentinel runs a series of checks on what you submitted. Some are mechanical — deterministic rules against known data. Some are AI-assisted — pattern analysis based on fraud investigation knowledge. Some use your vendor history to detect changes from prior submissions.

Signal checked	How it's checked	Type
Routing number validity	ABA checksum algorithm — every valid US routing number must pass this formula	Mechanical
Routing number → bank match	Federal Reserve routing directory lookup — confirms the routing number exists and identifies the associated financial institution. Note: this validates the routing number itself, not the specific account.	Mechanical
Email domain typosquatting	Character-level comparison against known typosquat patterns — transpositions, added hyphens, swapped characters, different TLDs	Mechanical
Routing / account number changed	Compared against your local vendor history — flags any difference from prior submissions for the same vendor	Memory
Urgency and pressure language	Detection logic built from fraud investigation patterns — identifies phrasing associated with social engineering	AI-assisted
Secrecy requests	Flags language asking the recipient not to discuss the request with others — a consistent BEC signal	AI-assisted
Structuring amounts	One factor considered is payment amounts that appear deliberately structured around common reporting thresholds. This signal is evaluated alongside other indicators and is never treated as evidence of fraud on its own.	Mechanical
BEC language patterns	Identifies patterns common to business email compromise — unreachability claims, wire-only restrictions, vague justifications	AI-assisted
Phantom vendor signals	Vague scope, round amounts for complex services, consumer email domains, low invoice numbers	AI-assisted
Link / domain analysis	Checks URLs for known phishing patterns, recent registration combined with impersonation indicators, and lookalike domain structures	AI-assisted

On the AI-assisted checks

The AI-assisted checks use Anthropic's Claude API, guided by detection logic derived from real fraud investigation workflows. Rather than asking a general-purpose model whether something "looks suspicious," PaySentinel instructs it to evaluate specific fraud indicators associated with business email compromise, phantom vendors, account takeover, and payment manipulation — the patterns a fraud analyst would look for, implemented as a structured check you can run in under a minute.

Findings are assembled into a risk score and specific flags

The result isn't just a number. PaySentinel returns a risk score, the specific signals that triggered it, and recommended next steps for each flag. The goal is to give you enough information to make a decision — not just a verdict.

Low risk

No significant signals detected. Proceed with normal verification practices — routing number valid, domain clean, no BEC language present.

Medium risk

One or more signals present that warrant attention. Review the specific flags before proceeding. A phone call to verify the vendor is recommended.

High risk

Multiple or critical signals detected. Hold the payment. Do not proceed until each flag is independently verified. Escalate to a second approver.

🔍 Fraud Analyst Perspective

A low risk score isn't a guarantee — it means no signals were detected in what you submitted. Fraud that relies on a legitimately compromised account, or a request that contains no written red flags, can still be fraudulent. PaySentinel is a structured second opinion, not a replacement for calling the vendor to verify payment details on any significant transaction.

You make the payment decision — with more information than you had before

PaySentinel doesn't block payments or connect to your bank. It gives you a structured risk assessment, specific red flags, and recommended next steps — then you decide what to do. That's intentional.

The tool is designed to support the verification process, not replace human judgment. The most effective fraud prevention combines a structured check (what PaySentinel does) with direct verification (calling the vendor using a number from your records). Both matter.

Limitations

What PaySentinel doesn't do.

Being clear about limitations is part of building a trustworthy tool. Here's what PaySentinel is not and what it can't catch.

🏦

Doesn't connect to your bank

PaySentinel doesn't monitor your accounts, initiate or block payments, or have any access to your banking information. It analyzes what you paste in — nothing more.

📊

Doesn't replace your accounting software

Three-way matching (invoice vs. PO vs. receipt) requires your internal records. PaySentinel doesn't integrate with QuickBooks, Xero, or similar tools.

👤

Can't detect a fully compromised account

If a legitimate vendor's email account is genuinely compromised and the attacker sends from the real address with no suspicious language, there may be no detectable signal. Phone verification remains the final defense.

🔮

Doesn't guarantee fraud detection

A low risk score means no signals were detected in the submitted information — not that the payment is definitely safe. Fraud evolves, and no automated check is a substitute for human judgment on large transactions.

⚖️

Doesn't provide legal or financial advice

PaySentinel's output is a risk assessment, not a legal or financial opinion. Decisions about fraud response, reporting obligations, and legal action should involve qualified professionals.

🔄

Doesn't recover lost funds

If a payment has already been made, PaySentinel can't reverse it. See our guide on what to do if you've sent money to a scammer.

Data & Privacy

What happens to the data you submit.

When you run an analysis, the payment details you enter are sent to our analysis engine for processing. We do not store or retain your submission data after analysis is complete.

Your case history and vendor memory is stored locally in your browser — not on our servers. Clearing your browser data removes it. We don't sell your data or use your submissions to train AI models.

For full details, see our Security & Data Practices page.

🔒

Encrypted in transit

HTTPS/TLS between your browser and our servers

⚙️

Processed

Signals checked, risk score generated, result returned

🗑️

Deleted after analysis

Submission data not retained once analysis is complete

Data handling summary

Analyzed but not retained: payment details, vendor info, invoices, email text

Stored locally in your browser: case history, vendor memory, investigation queue

AI provider: Anthropic (Claude API) — does not retain API inputs or use them for model training

Why it exists

Built by someone who investigated these cases.

PaySentinel was created by a fraud analyst with experience investigating account takeovers, counterfeit card activity, ATM compromise, and payment fraud. The detection logic isn't built from generic AI knowledge — it's built from the patterns that appear in real fraud cases, encoded into a tool that anyone can run before sending a payment.

The goal is simple: give small businesses access to the same investigator-style checks that financial institutions use, without an enterprise contract or a technical team.