Payment Fraud Triage — BEC & Vendor Fraud Verdict (CLEAR/VERIFY/HOLD)

About this skill

What it does A method the AI executes over a payment artifact you supply — a vendor email, an invoice, a bank-detail change request, a wire/ACH instruction — and checks it against the fraud patterns that actually cost money: business email compromise (BEC), vendor impersonation, lookalike/homoglyph domains, thread hijacking, CEO fraud, unauthorized IBAN/account changes. Output is a mechanical verdict: CLEAR, VERIFY, or HOLD — plus, on every HOLD or VERIFY, the exact action that would move it to CLEAR. The core question this skill is built around: when a vendor says "our bank account changed," who actually confirmed that, and where did the confirmation number come from? Most fraud losses in this category don't come from a badly-worded email — they come from a friendly, confident narration next to one hard fact nobody re-checked. Honest by design Every decisive claim is labeled verified, reported, or unverified. A control that wasn't executed is unverified — never quietly upgraded to reported because the story sounded convincing. Unverified sender does not equal verified sender. "We called and they confirmed" is not evidence unless the number called came from your own vendor records, not from the email being checked — this skill is built specifically to catch that distinction, because "not-checked" and "no hits" are two different claims and this method never blurs them into one. It also refuses to become something it isn't: no drafting phishing lures or "test" social-engineering content, and no profiling the employee who happened to send the email — the subject is always the transaction and the counterparty entity, never a person. Audited & signed Ships with a GPG-signed integrity manifest (MANIFEST.sha256 + MANIFEST.sha256.asc) covering the full assessment logic — the signal matrix, the verdict formula, the anti-false-CLEAR and anti-false-HOLD rules. Verify it yourself in three commands (references/VERIFY.md). Cross-check the fingerprint against this listing — an independent channel, exactly as the verification instructions themselves require: 3E5C 01D0 6619 A997 5C83 DDA7 7273 DD27 D9C1 E2B1 What's inside