Landed

The attack, three ways

1 A compromised vendor inbox: DMARC-clean, inside the real invoice thread, “we switched banks.”
2 A lookalike domain or display name, with the same message and a never-seen account.
3 A fooled clerk who types the attacker's account into the vendor record by hand. No email, no AI.

The invoice is real. The vendor is real. Only the destination changed.

Every bank-account change becomes a verification case.
Open invoices follow the request and are blocked until the case is verified.
A randomized sub-dollar probe deposit is sent to the new account.
Only the contact of record's read-back of that amount releases the account, in one database transaction.
After payment, Landed checks the money landed; if not, it prepares the recovery package.

Re-seed the fixtures (Settings → Re-seed) to create the demo cases; the fraud case replays here.

Permissions as enforced in the database, not as prompt instructions.

Capability	Agent (LLM / intake / package actions)	Human (dashboard)
Read a vendor email and PDF, extract a requested account	yes	yes (manual edit)
Open a case and queue the probe deposit	yes (via bankAccounts.createUnverified)	yes
Re-point open invoices to the requested account (held)	yes	yes
Record a stated amount	only trusted channels (voice of record, portal login); email is stored rejected	"Simulate vendor answer" in sim mode, labeled
Verify an account (markVerified)	no	no (only the bound confirmation does, atomically)
Pay	no	yes, and only to a verified current-version account of that vendor
Exceptional release	no	two distinct named approvers + written reason, from NEEDS_HUMAN only
Edit contacts or account status	no	supersede contact; add human-attested record contact
Draft the recovery package prose	yes, from deterministic fields; every number verified	reviews, signs, calls
Know the probe amount	no (not in prompts, tools, events, or public queries)	no (operator reads the bank statement; test-only endpoint is key-gated)

The bank (an in-database ledger unless Nessie is selected)
Time (a demo clock drives the same timers)
Vendor answers (a human types what the vendor sees; voice channel written, not dialed)
Email authentication results; the vendor's bank statement

91

unit and invariant tests

30/30

eval scenario runs (extractor on and off)

21/21

through the Claude extractor

0

false releases

These are results on scripted cases. They demonstrate behavior on these cases; they do not establish effectiveness against real-world fraud.

Trouvé: hold-by-policy plus an automated call with a yes/no transcript judge.
Trustpair, Eftsure: account validation against networks of previously verified vendors.
Charted and similar: detect suspicious change requests, stop at an alert.

Built with: Convex, Next.js, Claude, Nessie, Vapi + Cartesia (written), Playwright.

Tracks: Hyphenate, Microsoft, Convex, Capital One, Cartesia (conditional), Anthropic.

Team: Meridian Outdoor Co. demo · Run your own scenario