Check a vendor before you pay them

What gets checked

VAT / registration number

Looked up live against VIES for EU and Northern Ireland numbers, with the format validated per country first. For Belgium, Bulgaria, Czechia, Estonia, Finland, France, Greece, Latvia, Lithuania, Poland, Portugal, Romania and Slovenia the national register is read as well: that adds the company name and, where the register publishes it, whether the company is in liquidation, insolvent, struck off or no longer VAT-active. Those registers also answer on the days VIES does not. GB numbers get the official UK check digit verified, but no registry lookup — see the FAQ below.

IBAN

Structure and MOD-97 checksum, computed locally, plus the bank the account is held at where the country publishes its bank codes. Catches the transposed digits that proofreading misses.

EU sanctions list

Fuzzy name screening against a local copy of the EU, UK and US sanctions lists, refreshed daily. No other free vendor checker does this.

Company register

Company name, status and incorporation date — from Companies House for UK suppliers, and the French register for French ones. Names are searched as text, so a single company is only named when the match is exact — otherwise you get the near misses to choose between.

Sending domain

SPF, DMARC policy, MX records and registration age — whether someone could forge email that appears to come from them.

Guides

• A supplier emailed asking to change their bank detailsThe email looks normal, the sender is right, the invoice matches. This is the most common form of invoice fraud, and how to tell in ten minutes.
• VIES not responding? Here's what to doThe EU VAT validation service goes down regularly and has no uptime guarantee. What that means for your check, and what to do next.
• Bank detail change: verification checklistA one-page checklist for verifying a supplier’s request to change bank details before you pay: who called whom, on which number, who signed it off. Print it or save it as PDF.
• What "dkim=pass" actually proves about an emailEmail authentication passed. That proves the domain signed the message, not that the invoice is real or that the bank details on it belong to your supplier.
• Your bank now checks the payee name — what that covers and what it does notVerification of Payee has been mandatory across the euro area since October 2025. It settles who owns the account, and here is what it still cannot tell you.
• A Polish account that is not on the white list — check for a virtual account firstPolish telecoms, utilities and insurers issue a different account number to every customer. Those are not published, so a naive check calls them unlisted.
• The Polish white list — why a supplier’s bank account can be checkedPaying an unlisted account above PLN 15,000 costs you the tax deduction and can create joint liability for the supplier’s VAT. How to check before you pay.
• The supplier’s domain was registered recentlyA domain registered weeks ago that is now sending invoices is the strongest single signal this tool can show you. Why good email security does not offset it.
• How to find out when a supplier’s status changesA check tells you about the day you ran it. Registrations end, companies fail, names reach sanctions lists. What actually changes, and how to hear about it.
• The supplier is in liquidation, insolvent or struck offA national register says the company is winding up or gone, while its VAT number still checks out. What each status means, and what to do before paying.
• VAT number is valid but the company name is differentThe registry confirms the number but returns a name that does not match the invoice. Usually a trading name or a group company, occasionally something worse.
• The VAT number is not registeredTwo very different results read alike: a number belonging to nobody, and a real company that is simply not VAT-registered. How to tell which you have.
• How to check whether an invoice is genuineA practical order of checks for an invoice from a supplier you do not know well — what is verifiable, what is not, and where to stop.
• Why your IBAN failed validationAn IBAN that fails its checksum is almost always mistyped. How the check works, where to look for the error, and what it does not tell you.
• VAT number formats by countryThe prefix, length and pattern for every EU country, Northern Ireland and the UK — including the country codes that catch people out.
• What a sanctions "possible match" meansA possible match is a name-similarity result against the EU, UK and US sanctions lists, not a legal determination. What it means and how to resolve it.
• No DMARC policy — what that means for youA domain with no enforced DMARC policy can be forged by anyone. Why that matters when an invoice asks you to change bank details.
• Supplier banks in a different country to their VAT registrationA German supplier with a Lithuanian IBAN is usually fine and occasionally fraud. What the difference means, when it is normal, and the one question to ask.

Questions