About

Who built this

I am Jose Pollman. I build small, single-purpose, free tools and run them myself — this one, notspoofed.com for email authentication, whattofixfirst.com for page speed, subcovered.com for certificate-of-insurance tracking, and knowyourmouth.com.

There is no company behind this and no team. Everything on the site was written and is maintained by one person, which is worth knowing in both directions: nobody is upselling you, and when something here is wrong it is wrong because I got it wrong. Corrections go to hello@vetthisvendor.com and I answer them.

I wrote up the fraud this site was built around — The Most Common Invoice Fraud Passes Every Check I Built — on Medium.

Why it exists

The usual invoice fraud is not a fake company. It is a real supplier whose mailbox was compromised, sending a real invoice for real work, with one field changed: the bank account. Every automated check passes, because everything except the account is genuine. That is the case this site was built around, and it is why no result here ever says “safe to pay” and why every result repeats the same instruction — confirm the account by phone, on a number you already had.

Since 9 October 2025, banks across the euro area have had to run Verification of Payee: they check the account holder’s name against the IBAN before you confirm a transfer. It is a real improvement and it answers the one question this site cannot — does the account actually belong to them. It also says nothing about whether the company is in liquidation, struck off, sanctioned, or a domain registered three weeks ago. Those are the questions here. What Verification of Payee covers goes through it properly.

Everything else was a matter of where the answers live. The VAT registry, an IBAN validator, three sanctions lists, the company register and the domain’s DNS records are five different places. Checking all five by hand takes ten minutes, so in practice people check one, or none. This runs them from one submission.

How each check works

VAT / registration number. The format is validated locally first, per country, so a mistyped number is caught before anything is asked of a registry. The number then goes live to VIES, the European Commission’s own service, for EU and Northern Ireland numbers. Thirteen countries are additionally read against their own national register, which is the part that matters: VIES answers only whether a number is registered, and a company in liquidation, insolvent or struck off usually still has a VAT number that resolves in VIES perfectly cleanly. The national registers are also up on the days VIES is not. GB numbers get the official check digit verified locally and no registry lookup — see below.

IBAN. Structure and the MOD-97 checksum, computed here, with no third party involved and nothing transmitted. This is arithmetic: it catches the transposed pair of digits that proofreading misses, and it cannot tell you who owns the account. The bank the account is held at is named where the country publishes its bank codes.

Sanctions screening. A daily local copy of three lists — the EU consolidated list, the UK list from OFSI, and the US SDN list from OFAC — is screened by fuzzy name similarity. The threshold was measured rather than guessed, and it is set so that a false positive is rare, because a false sanctions match gets acted on. Both the name you typed and the name the registry returned are screened, since an invoice often carries a trading name and the list carries the legal one.

Company register. Companies House for UK suppliers, the official French recherche-entreprises for French ones. Both are text searches over a name, not a lookup by number, so a single company is named only when exactly one result matches after normalisation — otherwise you get the near misses to choose between. For a country neither register covers, nothing is searched and the card says so, rather than reporting that your Latvian supplier is “not on the UK register”.

Sending domain. SPF, DMARC policy, MX records and the domain’s registration age, read from public DNS and RDAP. Registration age is weighted above the email authentication on purpose: someone registering a lookalike domain configures SPF and DMARC properly, because they need the invoice to arrive, so the impersonator often authenticates better than the twenty-year-old real supplier. The age is the field that separates them.

What it deliberately does not do

• It never gives a single verdict. There is no “safe to pay” badge and no risk score. Each check gets its own independent answer. A score would invite people to act on a number that cannot carry that much meaning.
• It does not claim a sanctions determination. Name similarity against a published list is a prompt to look properly, not a legal finding.
• It does not tell you the bank account is right — except in Poland, the one country that publishes the accounts businesses register for VAT. Everywhere else no public source can, which is why every result says to confirm by phone.
• It does not watch anything unless you ask it to. A check is a check. Supplier Watch exists for repeat monitoring and it emails only when something changes.
• It does not store the invoice. A PDF dropped into the invoice checker is read in your browser; only the identifiers you confirm are ever sent.

Why it is free

It costs almost nothing to run. It sits on a server that was already there for other things, reads public data sources, and stores nearly nothing. There is no funding to justify and nothing to upsell, so there is no reason to put a check behind a signup form.

There are no ads and no trackers beyond a self-hosted, cookieless page counter. See privacy for exactly what that means.

Contact

hello@vetthisvendor.com — corrections, questions, anything about the tool.

privacy@vetthisvendor.com — deleting a saved result before it expires, or any question about what is stored. See privacy.

Sources

• EU VAT — the Commission’s VIES service, live per check.
• UK VAT — no registry lookup. HMRC moved its VAT checking API behind an approved-application process this site does not hold, so GB numbers are validated against the official check digit locally instead. That proves a number is not mistyped or invented; it cannot prove the number is registered, or to whom, so the result links to the free official checker on GOV.UK for that.
• Check digits — verified locally for 19 countries, using the published algorithm for each. This is arithmetic, so it works even when a registry is unreachable.
• Slovenia — the FURS taxpayer register, refreshed daily, which distinguishes a real company that is not VAT-registered from a number that belongs to nobody.
• Poland — the Ministry of Finance white list, live per check. It publishes the bank accounts of VAT-registered businesses, making Poland the one country where an IBAN can be checked against its owner.
• Romania — ANAF, live per check, including whether the company has been declared inactive.
• Estonia — the Äriregister bulk export, refreshed daily, including liquidation and bankruptcy, and whether a number belongs to a VAT group rather than one company.
• Greece — ΓΕΜΗ, live per check, including bankrupt, under liquidation and struck off.
• Bulgaria — the Commercial Register, live per check, including insolvency, liquidation and strike-off.
• Latvia — the Uzņēmumu reģistrs bulk export, refreshed daily, including terminated companies and open insolvency proceedings.
• Belgium — the KBO/BCE public register, live per check, including bankruptcy, dissolution, judicial reorganisation and a stopped entity.
• Lithuania — the JAR company register and the VMI taxpayer register together, live. The VAT number is not the company code, so the taxpayer dataset bridges the two; it also reports when a VAT registration has ended.
• Portugal — Citius, live per check, for insolvency and company-recovery proceedings where the supplier is the debtor. Records also name creditors, who are not.
• Czechia, Finland, France — the national business registers, for the company name where VIES returns none; France also reports a ceased company.
• Sanctions — three lists, refreshed daily and screened locally: the EU consolidated list, the UK list from OFSI, and the US SDN list from OFAC. The UK and US lists are read from the issuing authorities rather than a mirror. Ships and aircraft are excluded from all three. Only each authority’s own publication is authoritative.
• Company register — the Companies House Public Data API for UK suppliers, and the free official recherche-entreprises for French ones, live per check.
• Domain — public DNS records and RDAP registration data.

What you get, country by country is the same information as a table, and it is generated from the checks themselves rather than written by hand, so it cannot fall behind what the tool actually does.