In March 2026 a South Carolina town wired $545,598to a scammer using a domain one character different from its contractor's. Nobody was hacked. The email simply looked right.
POshield puts a green check next to the people who really are who they say they are, right inside Gmail and Outlook.
The green check means a Google Workspace or Microsoft 365 administrator at that person's own organization authorized them to send purchase orders and payment requests.
Business email compromise doesn't look like a scam. It looks like the vendor you already work with, in a thread you're already having.
A scammer registered a domain one character off from the town's contractor, using a capital I in place of a lowercase l. They joined an email thread already in progress and asked to switch the payment from a check to a transfer. Forensic investigators found no sign anyone had broken into the town's accounts. The money went to Utah. It took 45 days to notice.
The FBI recovers about 75% of funds reported within 72 hours. After 45 days, recovery is unlikely. Months later, the contractor still hasn't been paid.
A purchase order arrived from a real school's domain, with the school's real shipping address. The senders were responsive, and they answered the phonewhen the reseller called to verify. It was a genuine school, one that didn't know an old alumni account had been compromised.
Careful staff caught it in time. With POshield, their team could have spotted it much sooner: an alumni account would never be authorized to send purchase orders, so there would have been no green check.
POshield isn't built for one industry. It's built for four moments, and most organizations have all of them.
Free to be verified. Paid to see verified senders. Nothing to install for the people you're verifying.
An administrator signs in with Google Workspace or Microsoft 365. POshield confirms with your own directory that they really are an administrator, then records the organization on the blockchain as an irreversible hash. Names and email addresses are encrypted in our database and never written to the chain. Free, and it only needs to happen once.
Your administrator registers the specific people authorized to send purchase orders, send or approve invoices, or change payment details, not every employee. Their details are encrypted before they are stored. Keeping the list small is what keeps the verification meaningful.
When one of your verified people emails an organization you are connected with, a green check appears next to their name in Gmail or Outlook, with their organization, role, and authority available on hover.
POshield works through private one-to-one connections with the organizations you actually do business with, like contacts in your phone rather than a searchable list. Verification appears for your connections only.
Nobody can browse who you work with, and nobody can look up who at your company is authorized to approve payments. That information is exactly what an attacker wants, so POshield never publishes it.
Most organizations are on both. You send purchase orders, and you pay invoices.
Register your organization and the people authorized to send POs, invoices, and payment requests. Their names and email addresses are encrypted before they are stored. Costs nothing, and it stops your name being borrowed.
Maria is verified everywhere she emails your connections.
Get Verified, FreeYour team installs the POshield extension and signs in once. One seat per person who needs to see verified senders in their own inbox.
No green check? Then the sender isn't verified. Treat the request the way you would any stranger asking for money.
See pricingYou don't need everyone at once. Whether you work with ten counterparties or four hundred, the large payments and shipments run through a fraction of them. Start there and add more over time. Getting them verified is free, and it protects both sides.
Ten counterparties or four hundred, the picture is the same. You decide the order.
Register the people at your company who send POs, invoices, or payment requests. Now your name carries proof when you email anyone you’re connected with.
Start with the relationships carrying your largest payments and shipments, then work down the list. Invite one at a time or paste in a whole list. Verification is free for them and takes their administrator about five minutes.
Each organization you connect with is one more relationship where impersonation stops working, in both directions. The list only grows.
Impersonation: lookalike and one-character-off domains, spoofed senders, and strangers inserting themselves into a real email thread. This is how most business email compromise works, and it is what happened in Surfside Beach.
Even a compromised mailbox has to impersonate someone. Because your organization registers only the people authorized to move money or goods, a purchase order from a hacked account that isn't on that list carries no green check.
If a criminal gets inside the mailbox of the exact person who is authorized, and sends from their real address, the email genuinely is from them. No verification can say otherwise. For any change to payment details, the FBI's advice still stands and we repeat it: confirm by phone using a number you already have, never one from the email.
POshield is a verification layer that helps you make better decisions faster. It is not a guarantee, and it does not replace your own controls.
POshield is designed for organizations that take data protection seriously.
POshield checks the sender's address, which is already visible on your screen. It never reads subjects, body text, or attachments.
Email addresses and domains are converted to one-way hashes before anything is recorded. A hash cannot be reversed by anyone, including us. The blockchain never contains a name or an email address.
Names and email addresses in the registry are encrypted before they are stored, and decrypted only on our servers for the organization they belong to. Even in a database breach, they stay unreadable.
Only a verified Google Workspace or Microsoft 365 administrator can register an organization. We confirm it with your own directory, not by trusting an email address.
Only your administrators can see who your organization has verified. Nobody outside your organization can browse it, and there is no public search.
There is no POshield password to create. Sign in happens entirely through Google Workspace or Microsoft 365. Your sign-in confirms who you are.
POshield does not collect, store, or process any student data of any kind. Full documentation is available on our security page.
Getting verified is free, for any organization. You only pay for the people who need to see verified senders in their inbox.
1–2 seats
5 seats
25 seats
100 seats
Email support@poshield.comand we'll put together the right plan for your organization.
Add individual seats to any plan without moving up a tier. Manage seats and billing yourself from your account.
Every plan includes verification for the people you authorize to move money or goods, private connections, and the browser extension for Chrome and Edge.
Getting verified costs nothing. Start there.