One character is all
it takes. We catch it.
Telltale reads every message that reaches a monitored mailbox, learns who your real contacts are, and flags the moment someone impersonates one of them — before a payment goes out.
The forgery is never the whole email. It's one domain, one account, one wire instruction.
The FBI's Internet Crime Complaint Center has named business email compromise the most financially damaging category of cybercrime it tracks, year after year — not because the emails are sophisticated, but because almost nothing is watching for the one detail that gives them away.
is usually the entire difference between a real vendor's domain and the one impersonating it.
involved in most cases — just a convincing message and a bank account that isn't the usual one.
between "this looks like our usual invoice" and a wire that can't be recalled.
Telltale reasons about senders the way your accounts team would — if they checked every single message.
Every inbound message is scored against three questions, each one a real signal a fraud investigator would ask.
Have we actually corresponded with this address before?
Telltale builds a known-sender graph for every mailbox it monitors — quietly, in the background, from mail you've already exchanged. No contact list to maintain.
Is a stranger suddenly talking about money?
A first-time sender asking for a wire, a W-9, or updated banking details is exactly the pattern a real attacker produces — and exactly the pattern most inboxes never question.
Does this address almost — but not quite — match someone we know?
Telltale measures the actual character-level distance between an incoming domain and every domain you've dealt with before, and writes a visible, specific warning into the message when it's too close to be a coincidence.
Not an alert buried in a dashboard — a warning written directly into the message itself.
This is the exact HTML Telltale injects for a maximum-severity match, byte-for-byte — not a mockup. The flagged address, the real one it resembles, and the single differing character are all computed, not written by a person.
| telltale |
| New sender: | billing@northfeld-equity.com |
| Resembles known sender: | billing@northfield-equity.com |
Three patterns, caught the same way real finance teams eventually catch them — except Telltale doesn't need to get lucky.
Illustrative examples, not real correspondence.
"Our payment details have changed"
A capital I instead of a lowercase l in a supplier's domain, sent two days before an invoice is due, asking for a new account number.
Caught at signal 03 — flagged maximum.A real vendor, a hijacked inbox
The email genuinely comes from your vendor's real address — because their account was compromised — and it asks you to redirect this month's payment.
Caught at signal 01 — a known sender asking for something a known sender shouldn't.New wire instructions, old-looking email
"The title company" emails updated instructions the morning of closing. The domain is one character removed from the one you've used all month.
Caught at signal 03 — flagged maximum, with the exact character difference shown.One plan. No tiers to decode.
Per mailbox, per month
Every monitored mailbox, every detection tier, every warning banner — included. No setup fee, no seat minimums to negotiate.