The list finance already keeps, made machine-checkable. For each supplier: the domain they email from, the account number you have on file, and a phone number from your own records. When an email from that vendor asks for payment to go somewhere else, PhishGuard rates it CRITICAL and tells the reader to call that number. When a message uses a registered vendor's name from any other domain, same verdict. Account numbers are hashed on entry; the number itself is never stored.