EMAIL SECURITY FOR ACCOUNTANTS AND BOOKKEEPERSClient money,
paid to the client.
A practice moves other people's money every day: tax refunds, payroll and supplier invoices. That makes an email with new bank details look routine, which is exactly why it works.
Note 1: A hyphen the client's own website does not have
Hi Alex,
Thanks for letting me know the corporation tax refund has come through. We have moved our business banking, so please could you send it to our new account below rather than the one you have on filenote 2.
Note 2: New bank details for client money, by email
Account name: Fletcher Joinery Ltd Sort code: 11-22-33 Account number: 12345678
The old account is being closed at the end of the month, so it would be great if this could go out todaynote 3. Just reply to this email once it is done.
Note 3: Hurried, before anybody rings to check
Many thanks, Karen Fletcher Director, Fletcher Joinery Ltd www.fletcherjoinery.example
High riskJatzo's result for this fictional email
What moved the score
- Payment change with a warning sign+28
- Supplier payment details changed+16
- Tax or benefit claim lure+10
Invoice and mandate fraud, as UK Finance recorded it.
- £41.3 millionlost to invoice and mandate fraud in 2025
- 2,305cases recorded in the year
- 68%of the losses came from business accounts
Criminals intercept emails or take over an email account, then pose as a supplier, a solicitor or a builder with new bank details. UK Finance, Annual Fraud Report 2026, June 2026 (opens in a new tab)
What accountants worry about.
And what Jatzo does about each, in the inbox your team already uses.
Clients' records in the wrong hands
A practice holds clients' tax, payroll and bank details. A phishing email that takes one password can expose them, and a breach that risks harming people must be reported to the ICO within 72 hours.
What Jatzo does
The check flags fake sign-in requests and emails borrowing a name they do not come from, before anybody types a password. Jatzo keeps the findings, never the email or its attachments.
Every planPhishing in a client's or a partner's name
ICAEW describes a practice that paid a client's tax refund to a new account on an email the client never sent. Others arrive from a partner, urgently, asking for a payment.
What Jatzo does
The check names the warning signs in plain English, such as a reply address elsewhere, so a junior can make the right call without asking. A High risk result reaches your practice manager.
Business and Business ProRansomware locking the practice out
Ransomware often arrives as an attachment or a link somebody opened. Once it runs, the practice is back only when its files are restored from a backup.
What Jatzo does
Before anybody opens anything, the check looks inside attachments for macros, hidden scripts, risky archives and active PDF content, and checks links against Google Web Risk.
Every planJatzo does not restore files after an attack. Keep a backup that ransomware cannot reach, as the NCSC advises.
How it unfolds for accountants.
Money is due
The practice is about to pay a client's tax refund, or run a client's payroll.
- Check it here
New details arrive
An email in the client's or an employee's name gives new bank details for the money.
It looks routine
A practice moves other people's money every day, so new bank details look like routine work.
The refund goes elsewhere
Unless somebody rings the client on the number on file, the money goes to an account the client never gave.
The gold mark is where Jatzo's check fits: somebody has the email open and nothing has been paid yet.
The check before you pay.
Six steps, every time. Print it, put it by whoever pays the invoices, and agree that nobody skips it because somebody senior is in a hurry.
Download the one-page checklist (PDF)Never change a client's, employee's or supplier's bank details on the strength of an email alone.
Ring the person on the number already on your file, not one in the email, and note the call.
Before any refund or client money leaves client account, confirm the destination account by phone.
A second person approves every bank detail change and every client money payment.
For a new account, send a small amount first and have the payee confirm receipt by phone.
If money has gone, ring your bank's fraud line at once, then report to Report Fraud on 0300 123 2040 or reportfraud.police.uk (Police Scotland on 101 in Scotland).
Also on day one: tell the client, notify your professional indemnity insurer, and consider a Suspicious Activity Report to the National Crime Agency.
What the practice gets.
It does not replace the call. It makes sure somebody makes it. Jatzo adds a check beside the message in Outlook and Gmail, at the moment somebody decides whether to pay, reply or click, and your existing email protection stays as it is.
Check before the refund goes
Every planAnybody unsure about a client's new bank details presses Check in Outlook or Gmail and sees a score out of 100 with the reasons.
Every invoice against confirmed details
Separate licence, from £129 a yearInvoice Fraud Checker, a separate Windows program, compares the bank details on each invoice with the ones you confirmed for that supplier, and says Stop when they differ. About the Invoice Fraud Checker
Your practice manager hears at once
Business and Business ProWhen anybody checks a message scoring High risk or above, an email goes to addresses you choose at your own domain, such as your practice manager's.
See what is aimed at the practice
Business and Business ProThe organisation threat report counts the checks that reached Suspicious or above by kind of attack, the last 30 days against the 30 before, and names nobody.
Training for the whole practice
Business ProBusiness Pro includes every Training Centre course for everyone in the team, Invoice and payment fraud among them, with a record of who completed it.
A record for your indemnity insurer
Business ProBusiness Pro builds a dated proof pack of the checks made, training completed and domains watched, for your insurer or a client's due diligence.
Which plan fits: an example
For accountants with 8 people, we suggest Business Pro: £96 a month, or £960 a year paid annually.
That is £12 a person a month.
Training for everyone who changes bank details, and a dated proof pack for the indemnity insurer, are both on Business Pro.
Business Pro includes the threat report, so you know what is being aimed at the practice and whether it is getting worse: every email your team checked that came back Suspicious or above, by kind of attack, the last 30 days against the 30 before, naming nobody. At the start of each month a report goes by email to the addresses you choose, saying what was checked and what is still waiting.
- The Check button in Outlook, including on a phone, and in Gmail, for everybody in the team.
- Staff do nothing. Whoever looks after your email adds it once, for everybody.
- Nothing to replace. Your email, and the protection it already has, stay as they are.
- Jatzo keeps the score and the findings for up to 90 days, never the email or its attachments.
- Pay monthly, or a year in advance for ten months' price.
The Invoice Fraud Checker is a separate licence, from £129 a year. About the Invoice Fraud Checker
What your sector's own bodies say.
Each point is linked to where it was published, with its date.
Treat unexplained bank detail changes as a red flag, verify them against details already on file through contacts you already trust, and split supplier set-up, approval and payment between different people.
After a diverted client refund, tell the client, notify your professional indemnity insurer promptly and consider a Suspicious Activity Report.
Report Fraud replaced Action Fraud in December 2025. The number, 0300 123 2040, did not change. GOV.UK, Report Fraud: new service from City of London Police, December 2025 (opens in a new tab)
Questions accountants ask.
Does Jatzo read our client files or the rest of the mailbox?
No. Jatzo reads only the email somebody chooses to check, and the add-in cannot reply, forward, move, delete or change anything in the mailbox. It keeps the subject line, the score and the findings for up to 90 days, never the message or its attachments. Links in it are checked against Google Web Risk.
Does Jatzo check the bank details on an invoice?
The Check button looks for warning signs in the email, such as a request to pay a new account, but does not know which bank details are right for each supplier. Invoice Fraud Checker, a separate Windows program, compares each invoice with the details you confirmed.
Does it replace ringing the client?
No. ICAEW's advice stands: verify new bank details through contacts you already trust. Jatzo helps whoever reads the email notice that it needs that call, before the refund or payment leaves.
Will our IT company need to do anything?
A little, once. Whoever looks after your email proves your domain with one DNS record. For Microsoft 365 they then upload one file in the admin centre, which needs the Exchange Administrator or Global Administrator role, and Microsoft takes 24 to 72 hours to add the button. For Google Workspace they install Jatzo for the domain. Staff do nothing.
Check the next email that makes you pause.
For other businesses: Law firms; estate and letting agents; construction firms and architects; manufacturers, wholesalers and distributors; recruitment agencies; marketing and digital agencies; healthcare practices; insurance brokers and charities.