Comparison

Payment Guard and email security

Email filters keep forged senders out. But when a payment instruction comes from a real, compromised account, it passes SPF, DKIM and DMARC. Payment Guard looks at what still stands out: bank details, a payment instruction or a reply-to address that doesn’t fit this sender’s usual pattern.

New · rolling outSince October 2026 Payment Guard has been running in a learning phase for Pro customers: it learns how your senders ask for payments and shows nothing yet. Protime turns on the alerts (Outlook category “Protime: Verify Bank Details”, alert email, WhatsApp, security contact) after this learning phase.

Where email filters stop

An email filter checks whether a message really comes from the stated sender, whether a link is dangerous and whether a name merely looks similar. Against forged senders that works.

When an attacker has taken over the mailbox of a supplier, a colleague or the boss, they write from the real account. The technical checks pass, and according to Microsoft, impersonation protection does not apply when sender and recipient have already corresponded [1]. What still stands out is the content: new bank details, this sender’s first payment request, a reply-to address that doesn’t match.

That is exactly what Payment Guard checks, because Protime already works in your mailbox and knows your senders. It is not an email filter and replaces neither Microsoft Defender nor a gateway vendor. It adds the case filters don’t see.

The threat picture

970

CEO-fraud reports from Swiss companies reached the Federal Office for Cybersecurity (NCSC) in 2025, up from 719 the year before. It is the most frequent incident companies report.^14,15

USD 3.05 bn

in reported losses from business email compromise in the US in 2025, according to the FBI IC3 report (as cited by secondary sources).^16,17

9–17 %

of Swiss domains reject forged senders with DMARC “p=reject” (vendor studies, different samples).^18,19,20

Feature by feature

✓ yes · ◐ partly · – no · ? not documented in the sources checked

Feature	Protime Payment GuardNew · rolling out	Microsoft Defender for Office 365 P1	Proofpoint Essentials	Barracuda Email Protection	Abnormal Security	Fyxer	Superhuman
Email from a real, compromised account recognisable?	Yes: checks whether bank details, payment request and reply-to address fit the sender’s usual pattern	Not documented; per Microsoft, impersonation protection does not apply to senders you have already corresponded with¹	Not documented in the sources checked; Proofpoint offers behavioural analysis of supplier accounts in an enterprise product⁷	Not documented in the sources checked	Yes: behavioural baseline per sender, detection of compromised vendor accounts (per vendor)¹⁰	No fraud detection documented¹³	No fraud detection documented
Changed bank details in an ongoing conversation	Yes: new IBAN from a known sender, including a change of IBAN country	Not documented in the sources checked	Not documented in the sources checked	Not documented in the sources checked	Part of the behavioural analysis (per vendor)¹⁰	None documented	None documented
A sender’s first payment email	Yes, after a 30-day learning period per mailbox	Not documented in the sources checked	Not documented in the sources checked	Not documented in the sources checked	Not documented as a separate rule	None documented	None documented
Alert on a sent payment email, outside your own mailbox	Outlook: unusual sent payment emails are recognised; alert via WhatsApp or a security contact, never into your own mailbox. Gmail to follow.(after the learning phase)	Not documented in the sources checked	Not documented in the sources checked	Not documented in the sources checked	Not documented in the sources checked	None documented	None documented
Lookalike sender	Partly: known display name with an unknown address, mismatching reply-to. Lookalike domains not yet.	Yes: impersonation protection for users and domains^1,2	Yes: impersonation protection⁵	Impersonation protection in the higher tier^8,9	Not documented separately in the sources checked	None documented	None documented
Data storage	Stored in the EU and Switzerland; bank details only as a checksum	Not checked	Not checked	Not checked	Not checked	Not checked	Not checked
Built for	Family offices, solo professionals, SMEs without in-house IT	Microsoft 365 customers; included in Business Premium, usually set up by an IT provider⁴	SMEs, sold through resellers^5,6	SMEs, sold through resellers^8,9	Larger companies; minimum contract estimated at USD 25,000–50,000 a year^11,12	AI inbox with sorting and drafts	AI inbox focused on speed
Setup	Connect the mailbox (Microsoft 365 or Gmail); no MX change, no gateway	Part of Microsoft 365; configure policies in the Defender portal¹	Gateway filter in front of the mailbox (mail flow change)⁵	Filter, set up through a reseller⁹	Enterprise project, quote on request¹¹	Connect the mailbox	Connect the mailbox
Price per user per month	Included in Pro (CHF 25); Team CHF 25 per seat, from 5 seats	approx. USD 2–3; included in Business Premium (USD 22)^2,3,4	approx. USD 2.70–8.14 depending on tier and reseller^5,6	approx. USD 3–8^8,9	On request (estimates: USD 15–35 per person per year plus platform fee)^11,12	Not a security product; prices in the dedicated comparison	Not a security product; prices in the dedicated comparison

What Payment Guard does not do

It does not block payments. Protime has no access to your e-banking and is not meant to. It prompts the call-back; you make the call and the decision.
It only works in mailboxes connected to Protime. If a payment runs through a mailbox without Protime, it doesn’t see it.
Bank details that appear only in an attachment or an image are not read for now; the alert is weaker then.
It does not detect unusual sign-ins or new inbox rules. That is the job of Microsoft Defender, Entra ID and your IT provider.
If your own mailbox is compromised, the attacker can see and remove categories in it. That is why alerts about sent emails never go to your own mailbox, but to WhatsApp or a security contact.
Sent emails are checked on Outlook first; Gmail follows.
It also flags genuine changes, such as a new supplier’s first invoice. That is why the tone is “please verify”, never “fraud”.
Alerts go only to the mailbox owner, not to managers.

An alerting aid, not a guarantee

Payment Guard checks incoming and sent emails for payment instructions that deviate from the usual pattern. It can miss fraud attempts and also flags genuine changes. It does not block payments and does not replace a call-back on a number you know yourself. Protime is not liable for payments made with or without an alert.

Frequently asked questions

Does Payment Guard replace my email filter?

No. Filters such as Microsoft Defender, Proofpoint or Barracuda remain necessary: they keep out forged senders, dangerous links and attachments. Payment Guard adds payment emails from real, compromised accounts that pass every filter.

What happens when there is an alert?

Protime marks the email in Outlook with the category “Protime: Verify Bank Details” and states the reasons, for example “these bank details never came from this sender before”. When confidence is high, a separate alert email follows, and WhatsApp if you turn it on. The request is always the same: before paying, call the sender on the number you know, not the one in the email. A Protime alert never asks for a login, a payment or a click on an unknown link. During the learning phase you won’t see alerts yet; Protime turns them on afterwards.

Who gets Payment Guard?

All customers on the Pro or Team plan, at no extra cost. It is not part of the Starter plan. It works in every mailbox connected to Protime.

Does Protime store my bank details?

No, only a checksum. That lets Protime tell whether bank details appeared before without keeping the number itself. Alerts never show the full IBAN.

Payment Guard is included in the Pro plan. 14-day free trial, no credit card.

Start free

All pricing · Compare with Fyxer · Compare with Superhuman · All comparisons

Sources and notes

Prices: indicative per user per month from public price lists and reseller information, as of October 2026, without warranty. Actual prices depend on tier, reseller and contract term.

Statements about other vendors follow their public documentation. “Not documented” means not found in the sources checked, not that it doesn’t exist. “Not checked” means outside the scope of this comparison. We welcome corrections.

Microsoft Learn, Anti-phishing policies in Microsoft 365: https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about
TrustedTech, Defender for Office 365 Plan 1 vs Plan 2: https://www.trustedtechteam.com/blogs/microsoft-365/microsoft-defender-for-office-365-plan-1-vs-plan-2
G2, Microsoft Defender for Office 365 Pricing: https://www.g2.com/products/office-365-advanced-threat-protection/pricing
LazyAdmin, Microsoft 365 Business Standard vs Premium (2026): https://lazyadmin.nl/office-365/microsoft-365-business-standard-vs-premium-2026-update/
Iron Cove Solutions, Proofpoint Essentials: https://ironcovesolutions.com/proofpoint-essentials
Syncro, Proofpoint Integration (Händlerpreise): https://docs.syncromsp.com/imported/proofpoint
Proofpoint, Introducing Supplier Threat Protection: https://www.proofpoint.com/us/blog/email-and-cloud-threats/introducing-proofpoint-supplier-threat-protection
CostBench, Barracuda Email Protection: https://costbench.com/software/email-security/barracuda-email-protection
Iron Cove Solutions, Barracuda Pricing: https://ironcovesolutions.com/en-US/barracuda-spam-filter-pricing
Abnormal, Vendor Email Compromise (Produktseite): https://abnormal.ai/platform/product-demos/vendor-email-compromise
UnderDefense, Abnormal Security Pricing Guide (Juni 2026): https://underdefense.com/blog/abnormal-security-pricing-guide/
CostBench, Abnormal Security: https://costbench.com/software/email-security/abnormal-security/
Fyxer, Security: https://www.fyxer.com/security
Netzwoche, 06.01.2026: Jahreszahlen BACS 2025 (Sekundärquelle): https://www.netzwoche.ch/news/2026-01-06/cybervorfaelle-nehmen-2025-nur-leicht-zu-aber-das-ist-kein-grund-zur-entwarnung
BACS, Halbjahresbericht 2025/II: https://www.ncsc.admin.ch/dam/ncsc/de/dokumente/dokumentation/lageberichte/BACS-HJB-2025-2_DE.pdf.download.pdf/BACS-HJB-2025-2_DE.pdf
Insurance Business, BEC-Schäden IC3 2025 (Sekundärquelle): https://www.insurancebusinessmag.com/us/news/cyber/business-email-fraud-drives-bulk-of-us-cybercrime-losses-analysis-590687.aspx
McDonald Hopkins, FBI IC3 Report 2025 (Sekundärquelle): https://www.mcdonaldhopkins.com/insights/news/the-sobering-truth-of-the-fbis-2025-internet-crime-complaint-center-report
DmarcDkim.com, DMARC Adoption Switzerland, Dezember 2025: https://dmarcdkim.com/dmarc-adoption/switzerland/december-2025
PowerDMARC, Switzerland DMARC Adoption Report 2026: https://powerdmarc.com/switzerland-dmarc-adoption-report/
dmarcian, Switzerland DMARC Adoption (Top 100): https://dmarcian.com/switzerland-dmarc-adoption/

All sources retrieved on 26 October 2026. Product names mentioned are trademarks of their owners.