PaylinkGuard

Who it's for

SMB finance staff / AP clerks who currently copy/paste invoice links into a browser or phone and manually inspect domains, bank account numbers, and PDF line-items to decide whether to pay (today they use email+manual web checks and gut judgment).

The problem

payment hurt + time: risk of wire/ACH/fake-invoice fraud leading to >$1k losses per incident plus 10–30 minutes per suspicious invoice spent chasing confirmations; also compliance/admin overhead reconciling mistaken payments.

How to build it

Browser extension (Gmail/Outlook web) + small webhook service that fetches link targets and returns a signed JSON verdict; optional Slack/email bot that accepts forwarded invoices and replies with the same verdict PDF. Concrete: highlight links in-message, one-click 'Verify payment link' that returns a 1-page PDF verdict and a machine-readable proof bundle (domain WHOIS, TLS cert info, resolved IP + ASN, payment provider token presence, payee name/account vs invoice line-items).

How it makes money

Who pays: SMBs / bookkeeping firms or their clients pay per-seat or per-organization — e.g., $8–25/user/mo or $50–150/org/mo for volume; why they pay: reduces theft risk and time spent verifying invoices and provides auditable proof for internal approvals/insurers; why they can't use free option: free options are manual checks or generic URL scanners that don't produce matched-payee accounting evidence (account number/name vs invoice), nor embedded PDF verdicts attachable to ERP workflows.

Why it doesn't exist yet

Incumbents (banks, ERPs, payment providers) don't ship this because it requires cross-checking arbitrary vendor emails/links and producing readable legal-grade proof — that touches multiple providers' surfaces and would add liability; banks prefer to lock value flows rather than surface risk signals in other people's inboxes. An indie can ship a low-liability verification layer that only reads link metadata and produces a human-verifiable bundle without touching funds, thus avoiding heavy regulations and integration needs.

First users

First 10 users: early-adopter SMBs with recurring vendor invoice fraud experience (accountants, small legal/creative agencies) will try it because it's faster than calling vendors, reduces fraud risk, and produces a short proof PDF they can attach to an approval chain; beta testers will be recruited via accounts-payable Slack communities, anti-fraud forums, and bookkeeping agencies that already sell advisory services.

Build size

2 people x 8 weeks (1 frontend dev to build the browser extension + Slack bot UI; 1 backend dev to implement safe link fetcher, WHOIS/TLS/ASN checks, payment-provider heuristics, proof-PDF generator). Scope included: Gmail/Outlook web extension, Slack/email bot endpoint, proof bundle generator, hosted backend on a $20/mo VPS. Excluded: direct bank integrations, automatic payment blocking, and enterprise SSO/saml single sign-on.

Biggest risk

A major email provider or browser vendor could ship native link-verification APIs (e.g., Gmail adds 'Verify payment' with matching proof) or a large accounting SaaS (Xero/QuickBooks) adds the feature, removing the need for an indie extension; alternatively, new standardized signed-invoice formats could make the indie's checks redundant.

Conditions for a hit (all 3 required)

• Verdict PDF: given a forwarded invoice email or clicked payment link, produces a one-page signed PDF within 60s containing (A) pay/don't-pay recommendation, (B) matched payee check showing 'invoice payee name vs claimed payee name/account' with exact string diffs, and (C) timestamped evidence headers (resolved IP, ASN, TLS cert fingerprint) — verifiable by a stranger in 6 months.
• Auto-detection heuristics: for any payment URL visited, the system lists which payment provider tokens/markers it found (e.g., stripe.hosted_invoice, paypal.me, bank-redirect patterns) and reports 'provider-claim: Stripe'+'hostage: mismatch' if provider marker absent or domain not owned by payee WHOIS owner — exact boolean outputs recorded in the proof bundle.
• One-click proof bundle: produces a machine-readable JSON bundle and a human PDF that includes (i) raw HTTP redirect chain, (ii) WHOIS record age and registrant org, (iii) ASN owner and geo, and (iv) extracted invoice line-items matched to claimed payee name — each field present or absent is observable and time-stamped within the bundle.

How it's judged (in 6 months)

Product Hunt daily top 5 OR GitHub 1,000 stars for the repository OR 50 paying orgs (choose whichever comes first)(judgment date 2027-02-19)

AI self-confidence 55/100 — self-reported likelihood of meeting the criterion, not a business success rate