Make "call them back" impossible to skip.
Set up your workspace, add your top suppliers and executives, invite a second approver. That's it.
Get startedAI lets criminals clone your CEO's voice, fake your supplier's emails and write flawless invoices. VouchSafe makes sure no money moves and no bank detail changes until the real person confirms it on a number you already hold.
Business email compromise is already the costliest fraud hitting businesses, and generative AI makes it cheaper, faster and more convincing. Small firms are exposed because approvals run on trust and familiarity.
Detecting AI-written text and deepfakes is an arms race defenders lose. VouchSafe scores what attackers can't hide — where a request really came from and what it asks for — then enforces the one control that beats every variant.
The Outlook and Gmail add-ins score each message in the reading pane: lookalike domains, display-name spoofing, failed authentication, payment-detail changes, secrecy, urgency, code requests.
Risky requests become a verification case with the exact steps your policy requires. Anyone on the team can stop a payment.
VouchSafe texts or calls a code to the number in your trusted directory — never one from the message. The real contact reads it back. An impersonator can't.
Above your threshold a different person approves. Every step lands in a tamper-evident audit log your bank and insurer can rely on.
Built for businesses with no security team: plain-language verdicts, policy you set once, and steps staff can follow under pressure.
Risk verdict and next steps inside the inbox, with one click to open a case. Works in Outlook desktop, web and Mac, and Gmail on Google Workspace.
One-time codes by text or voice to the number on file. Changed numbers are locked out of callbacks for 24 hours, so a hijacked account can't swap the number and approve itself.
When a supplier's bank details change in your ledger, VouchSafe restores the verified details within seconds and opens a case. New details are applied only after verification.
Requesters, verifiers, approvers and admins. The person who opened a case or made the callback can never give the second approval.
Every action, hash-chained with SHA-256. Verify integrity in one click and export it as evidence for your bank, insurer or auditor.
Realistic deepfake, voice-clone and BEC scenarios for team meetings, plus a minute-by-minute playbook for the first hours after a loss.
The risk engine is evaluated on frozen, held-out test sets that rules are never tuned on, with every test run logged. Latest held-out run (50 messages, threshold "elevated"):
| Metric | Result |
|---|---|
| Fraud caught (recall) | 80.8% (95% CI 65–92%) |
| Flags that were real fraud | 95.5% |
| Legitimate mail wrongly flagged | 4.2% |
| ROC AUC | 0.973 |
Early test sets written by the rule authors: directional, not a guarantee. The method, the data and every test run are published with the product.
"A polished, error-free message is not evidence of legitimacy. The out-of-band callback is what defeats the fraud."
That's why a low score never removes a verification step: any request that moves money still requires a callback on the number on file and, above your threshold, a second approver.
One flat price per business, not per seat. Every plan keeps the rule that matters: no money moves until the real person confirms it.
For trying VouchSafe and training staff
For businesses that pay suppliers by email
For teams running QuickBooks or Xero
Prices in US dollars, excluding tax. Pay annually and get two months free. Callback texts and calls are billed by Twilio to your own account at its standard rates, usually a few cents each. MSPs and insurers rolling VouchSafe out to many clients: ask us about volume pricing.
It doesn't try to judge whether a voice or video is synthetic — detectors are unreliable and attackers iterate faster. It treats any money or access request over voice or video as unverified and routes it to a callback on a number you already hold, which works however good the fake is.
VouchSafe is self-hosted: the server and its database run on infrastructure you control. Integration tokens are encrypted at rest. The free offline checker stores nothing outside your browser.
The ledgers don't let outside apps veto an edit in real time, so VouchSafe reacts to their change notifications: it restores the last verified details within seconds and opens a case. It only writes the new details back once the case is verified and approved. You can also check any supplier's status before a payment run.
Callbacks go through your own Twilio account (text or voice), at Twilio's standard rates. Without Twilio, staff can record manual callbacks they place themselves.
Small teams are the main target precisely because one person can be talked into one payment. VouchSafe works with two people: one verifies, the other approves.
Set up your workspace, add your top suppliers and executives, invite a second approver. That's it.
Get started