About
Why this exists
Before paying an unfamiliar supplier there are several things worth checking, and they live in as many different places: the VAT registry, an IBAN validator, the EU sanctions list, the UK company register, and the domain's DNS records. Checking them all by hand takes ten minutes and most people check one, or none. This runs them all from a single submission.
The sanctions check is the part no other free tool does, and the sending-domain check is the part most closely connected to how invoice fraud actually works.
What it deliberately does not do
- It never gives a single verdict. There is no "safe to pay" badge and no risk score. Every check gets its own independent answer. A score would invite people to act on a number that cannot carry that much meaning.
- It does not claim a sanctions determination. Name similarity against a published list is a prompt to look properly, not a legal finding.
- It does not tell you the bank account is right. No public data source can. That is why every result says to confirm by phone.
Why it is free
It costs almost nothing to run. It sits on a server that was already there for other things, uses public data sources, and stores nearly nothing. There is no company behind it, no funding to justify, and nothing to upsell — so there is no reason to put a check behind a signup form.
There are no ads and no trackers beyond a self-hosted, cookieless page counter. Seeprivacy for exactly what that means.
Who made it
Built and run by one person, alongsidenotspoofed.com, a free email authentication checker. The two share the sending-domain machinery.
Contact
hello@vetthisvendor.com — corrections, questions, anything about the tool.
privacy@vetthisvendor.com — deleting a saved result before it expires, or any question about what is stored. Seeprivacy.
security@vetthisvendor.com — security issues. Good-faith reports are welcome; seeterms andsecurity.txt.
Corrections
If a check gives a wrong answer — particularly a sanctions match against a company that is clearly not on the list — that is worth reporting tohello@vetthisvendor.com, and worth fixing. The matching threshold is tuned to avoid exactly that, and a real example is more useful than any amount of tuning in the abstract.
Sources
- EU VAT — the Commission's VIES service, live per check.
- UK VAT — no registry lookup. HMRC moved its VAT checking API behind an approved-application process this site does not hold, so GB numbers are validated against the official check digit locally instead. That proves a number is not mistyped or invented; it cannot prove the number is registered, or to whom, so the result links to the free official checker on GOV.UK for that.
- Sanctions — the EU consolidated list of persons, groups and entities subject to financial sanctions, refreshed daily and screened locally. Only the version in the Official Journal is authoritative.
- UK company register — the Companies House Public Data API, live per check. Company names are searched as text, so this reports a single company only when one matches the name exactly, and otherwise shows the near misses rather than picking one. A company being on the register proves it exists — not that it sent your invoice.
- Domain — public DNS records and RDAP registration data.