# Understanding the fraud warning | SmartMail Documentation

> When business email compromise signals such as a fake supplier and an IBAN change combine, a red or yellow banner appears at the very top of the reading screen.

Source page: https://dblinx.net/en/smartmail/belgeler/kullanici/dolandiricilik-uyarisi

---

# Understanding the fraud warning

When SmartMail catches typical combinations of business email fraud (someone writing for the first time + changed bank details, a domain very similar to a familiar company + payment request), it shows a banner at the top of the reading screen.

- Every user who can see the email

## How to understand the fraud warning

When SmartMail catches typical combinations of business email fraud (someone writing for the first time + changed bank details, a domain very similar to a familiar company + payment request), it shows a banner at the top of the reading screen. Who can do this: Any user who can see the email. 2 Before making a payment or updating bank details, call the other party on a phone number you already knew and verify.

## When the banner appears

- The sender domain closely resembles your domain or a company that this mailbox has previously **sent email to** (e.g. supplier-company and supplier-c0mpany).

- The email contains new or changed bank / IBAN details or requests payment.

- Accompanying signs: a sender you have never corresponded with before, a new contact on behalf of the same organization, replies going to a different address, language that creates urgency.

- 1Critical alert

- 2What should be done

Critical warning for similar domain and IBAN change, with demo data.

**Warning: possible fraud** 1 (red): when a bank detail change arrives together with another suspicious marker or a lookalike domain with a payment request. **Email to watch** (yellow): a bank detail change on its own or a lookalike domain.

**What to do**2 Before making a payment or updating bank details, call the other party on a phone number you already know and verify. Do not use the number or link in the email.

## Related pages

- [Reading the security report](/en/smartmail/belgeler/kullanici/guvenlik-raporunu-okuma)

- [Security](/en/smartmail/guvenlik)