Invoice Verify — Austria

Fraud detection for invoices from Austrian companies. Verifies the invoicing company exists, validates payment details (IBAN, BIC, VAT), screens for sanctions and adverse media, analyzes sender domain trustworthiness, and produces a plain-language fraud assessment.

14 steps x402 eligible Includes an AI-written summary invoice-verify-at

What it runs

Austrian Company Data
Source: Firmenbuch (Republik Österreich, BMJ) via JustizOnline IWG/HVD API
EU VAT Validation
Source: VIES (EU VAT Information Exchange System, European Commission)
VAT Number Format Check
Source: Algorithmic validation (EU VAT number format rules per country)
IBAN Validation
Source: Algorithmic validation (ISO 13616 IBAN standard + bank registry)
Bank BIC Lookup
Source: SWIFT/BIC directory (bank identification)
Sanctions Check
Source: Dilisense consolidated (OFAC SDN, EU FSF, UN SC, UK Sanctions List, CH SECO, BIS, World Bank, EBRD, ADB + 125 national sanctions/debarment lists; full attribution at https://dilisense.com/en/sources/sanction-sources)
Adverse Media Check
Source: Dilisense Adverse Media (235k+ news sources, FATF-categorized) primary; Serper.dev (Google search) fallback
Invoice Validation
Source: Algorithmic (invoice field validation, cross-check calculations)
Domain Reputation
Source: Threat intelligence feeds (multi-source scoring)
WHOIS Lookup
Source: WHOIS protocol (ICANN-accredited registrar databases)
Email Validation
Source: Algorithmic (syntax) + DNS protocol (MX record verification)
DNS Lookup
Source: DNS protocol (authoritative nameservers)
Redirect Trace
Source: HTTP fetch (manual redirect following, full chain capture)
Risk Summary Writer
Source: Claude Sonnet (Anthropic API)

Written by an AI model from the other steps’ results, for a person to review. It does not make the decision.

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`bic`	string	No	BIC/SWIFT code from the invoice
`iban`	string	No	IBAN from the invoice payment details
`sender_url`	string	No	URL from the invoice for redirect tracing
`vat_number`	string	No	VAT number from the invoice
`company_name`	string	Yes	Austrian company name or register number
`invoice_data`	object	No	Structured invoice data for validation
`sender_email`	string	No	Email address of the invoice sender
`sender_domain`	string	No	Domain of the invoice sender

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/invoice-verify-at/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "bic": "ESSESESS",
      "iban": "SE4550000000058398257466",
      "company_name": "Red Bull GmbH",
      "sender_domain": "example.com"
    },
    "max_price_cents": 250
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/invoice-verify-at \
  -H 'Content-Type: application/json' \
  -d '{
    "bic": "ESSESESS",
    "iban": "SE4550000000058398257466",
    "company_name": "Red Bull GmbH",
    "sender_domain": "example.com"
  }'

The bundle’s published example input.

Limitations

If `company_name` matches several entries without a unique exact name match, the tool returns a candidate list with names, FN identifiers and seats instead of selecting one. Firmenbuch name search does not rank by relevance; retry using a candidate identifier.
From step: Austrian Company Data
What to do instead: Call again with registration_number taken from the returned candidate list.
`status` is derived from current registration blocks because the Kurzinformation extract has no explicit status field; insolvency or liquidation markers appear in `status_note` only for name searches. Struck-off companies return an error rather than historical data.
From step: Austrian Company Data
Austrian beneficial-ownership data lives in the WiEReg (separate register, paid BMF access) and is not part of the Firmenbuch HVD datasets. ubo_availability is reported as unavailable_no_registry.
From step: Austrian Company Data
The IWG HVD tier returns the Kurzinformation extract: current officers with roles and representation authority. Full historical extracts, documents (Urkunden), and shareholder data are not included in the granted scope.
From step: Austrian Company Data
Lookup accepts a Firmenbuchnummer or company name, not an Austrian UID or ATU-format VAT number. The tool does not resolve VAT numbers to Firmenbuchnummer identifiers.
From step: Austrian Company Data
What to do instead: Look up the company by name, or find its Firmenbuchnummer on an official company document.
Name lookup takes about 4 seconds and can slow down under registry load. A known Firmenbuchnummer supplied as `registration_number` takes about 1 second.
From step: Austrian Company Data
What to do instead: Pass registration_number instead of company_name when the FN is known.
Data is reused under the Austrian IWG with a CC BY 4.0 attribution condition. Every response carries the attribution string in provenance; consumers republishing the data must preserve it.
From step: Austrian Company Data
VIES can be unavailable or throttle requests under unpublished per-member-state limits. Transient faults are retried, and cached results, including older fallback results, can be returned during outages.
From step: EU VAT Validation
What to do instead: Lookups within 48 hours can use cached results; if VIES is unavailable and no cached result exists, retry later.
Results can be cached for 48 hours, and national registry changes can take a further 24 hours to appear in VIES. Check the national tax authority directly for same-day registration or deregistration confirmation.
From step: EU VAT Validation
What to do instead: For real-time same-day verification, contact the national tax authority directly.
Swiss UID validation returns valid or invalid only, without a company name or address. This tool does not perform the separate enrichment lookup, whose public service is limited to 20 requests per minute.
From step: EU VAT Validation
What to do instead: For Swiss company name + address, call the swiss-company-data capability.
GB VAT numbers return a credentials-pending error when the HMRC connection is not configured.
From step: EU VAT Validation
What to do instead: Use vat-format-validate for GB format checks; it does not confirm VAT registration.
Validates the number format against country patterns only. It does not check check digits or confirm that the number is registered or active
From step: VAT Number Format Check
What to do instead: Use vat-validate for VIES database confirmation after format validation passes
Validates structure and checksum only — does not confirm the account is open or active
From step: IBAN Validation
What to do instead: Use a SEPA test transaction (€0.01) or bank account verification API to confirm the account is live before large transfers
Covers all SEPA-zone IBANs. Non-SEPA country IBANs validated structurally but bank lookup may be incomplete
From step: IBAN Validation
What to do instead: For non-SEPA IBANs, cross-reference the bank code portion against SWIFT's IBAN Plus directory
BIC directory updated monthly — newly merged or renamed banks may show outdated information for up to 30 days
From step: Bank BIC Lookup
What to do instead: Cross-check the returned BIC against SWIFT's online BIC search (swift.com) for recently merged institutions
Database covers major banks globally. Small regional banks or credit unions may not be found
From step: Bank BIC Lookup
What to do instead: If no result is returned, look up the BIC via the national central bank's payment system participant list
Sanctions lists updated daily from OFAC, EU, and UN sources — newly sanctioned entities may take up to 24 hours to appear
From step: Sanctions Check
What to do instead: For same-day compliance, subscribe to OFAC's RSS feed and cross-reference against today's additions
Name matching uses fuzzy logic — common names may produce false positives. Always verify flagged results
From step: Sanctions Check
What to do instead: Filter results by match confidence score and verify flagged entities against the primary sanctions list PDF
AI-classified results — may miss subtle risk signals or produce false positives
From step: Adverse Media Check
Limited to publicly indexed web content — paywalled news sources not covered
From step: Adverse Media Check
English-language bias — non-English media coverage may be underrepresented
From step: Adverse Media Check
Recency depends on search index freshness (typically 24-48h delay)
From step: Adverse Media Check
AI-categorized results — may produce false positives for common names or names that appear in unrelated news contexts
From step: Adverse Media Check
What to do instead: Review top articles manually to confirm relevance. Use entity_type parameter to improve precision
Screens 235,000+ sources but paywalled content may not be fully indexed. Non-English language coverage varies by region
From step: Adverse Media Check
What to do instead: For high-stakes screening, supplement with manual searches in local-language news sources
Articles typically appear in near real-time but some sources may have a 24-48 hour indexing delay
From step: Adverse Media Check
What to do instead: For breaking news events, supplement with direct web search
Validates invoice structure and arithmetic — cannot verify that billed items were actually delivered or that prices match contracts
From step: Invoice Validation
What to do instead: Use as a structural pre-check before manual review of business terms and delivery confirmation
Reputation scores aggregate multiple blocklists — a single listing may not indicate actual malicious activity
From step: Domain Reputation
What to do instead: Check which specific blocklist flagged the domain in the response details and verify the listing reason before blocking
Blocklist data refreshed daily — recently resolved issues may still show negative reputation for 24-48 hours
From step: Domain Reputation
What to do instead: If a domain was recently cleaned, re-check after 48 hours and use the trend direction to assess improvement
Some registrars rate-limit WHOIS queries — bulk lookups may see slower response times
From step: WHOIS Lookup
What to do instead: Batch lookups with 1-2 second delays between requests, or use the RDAP protocol endpoint when available
GDPR-redacted registrations (common for EU domains) show limited registrant information
From step: WHOIS Lookup
What to do instead: Use the abuse contact email from the WHOIS response to request registrant details through the registrar's disclosure process
Disposable email detection covers major providers but new throwaway domains may not be flagged
From step: Email Validation
What to do instead: Check the domain’s age when investigating suspicious traffic.
No mailbox is contacted. A made-up or bouncing address can return valid if its syntax is correct, its domain has mail servers, and it is not flagged as disposable. Catch-all domains are one example; mailbox existence and delivery are never checked.
From step: Email Validation
What to do instead: Require confirmation through a verification link before relying on a mailbox.
Results reflect current DNS propagation — recent changes may take up to 48 hours to appear
From step: DNS Lookup
What to do instead: Query the authoritative nameserver directly (returned in the NS records) to see changes before full propagation
Follows HTTP redirects (301, 302, 307, 308) — JavaScript-based redirects and meta refresh tags are not traced
From step: Redirect Trace
What to do instead: For JavaScript redirects, use screenshot-url or url-to-markdown to see the final rendered destination
Risk narratives are generated by AI and may oversimplify complex scenarios. The narrative should be reviewed by a qualified professional for high-stakes decisions.
From step: Risk Summary Writer
The AI is instructed to follow specific wording rules (e.g., never say "safe to pay") but adherence is not 100% guaranteed. Automated wording checks are recommended.
From step: Risk Summary Writer
Narrative quality depends on the completeness of input check_results. Missing or incomplete check data will produce less useful narratives.
From step: Risk Summary Writer