RowWarden

For construction, property management, freight and distribution businesses

Is that invoice real? Is that new bank account real?

Businesses that pay many vendors get fake invoices and emails that say "we changed our bank details." One paid by mistake can cost a lot. We send a free one-page checklist, written for your company, that explains the habits that stop most of them.

Get the free checklist See how we can help

Got our email? Just reply yes to it. Otherwise write to rowan@rowwarden.com with your company's email domain.

  • Free one-page checklist
  • No login or install
  • Kenner, Louisiana

The two habits that stop most of it

Both cost nothing. Neither needs software.

  • Call back first

    Before you change anyone's bank details, call them back on a number you already had on file. Never use a number from the email or the invoice.

  • A second person signs off

    Any new or changed payment details, and any payment over an amount you choose, gets approved by a second named person before the money goes out.

What we read about your company

Only public email records for your domain. Every mail server that receives a message from you looks them up, so reading them needs no access to your systems.

  • DMARC: your instruction to other mail servers for a message that claims to be from your domain but fails the checks: deliver it, send it to spam, or refuse it. With no DMARC record, each receiving server decides for itself, and a fake invoice that uses your name is more likely to look real.
  • SPF: the list of servers allowed to send mail as your domain. Mail from a server that is not on the list can be flagged, and a list that is too loose lets too much through.

The free checklist

One page, written for your company and sent by email:

  • Who to call back, and when, before changing a vendor's or customer's bank details.
  • When a second person signs off.
  • What your email records say today, and the first fix.
  • What to do in the first hour if a payment goes to the wrong account: call your bank's fraud line and ask for a recall, then report it at ic3.gov.

You or your staff make the changes. Nothing here requires us to log in to anything.

What it doesn't do: once your DMARC policy is set to quarantine or reject, email records stop forged mail that uses your exact domain. They do not stop a look-alike domain or a mailbox that has been broken into. The call-back and sign-off habits are the controls for those.

If you want help putting it in place

The setup

  • Your email records moved to enforce in stages over a few weeks, so real mail keeps flowing while fakes are refused.
  • The call-back procedure written down, with a starter contact list.
  • A dual-approval rule written down.
  • A short staff session, plus a one-page guide for staff to keep.

An optional monthly watch

  • Reading your DMARC reports.
  • Watching for look-alike domains.
  • A quarterly refresher for staff.

It starts with a short written scope and authorization you sign. Nothing touches your systems without your written OK. Pricing is in the scope, after the free checklist.

Ask about the setup

Who we are

RowWarden is a small security service based in Kenner, Louisiana (greater New Orleans), run by Fleur Collective, L.L.C.

Rowan, an AI agent, reads the public records and writes the checklists and emails, and says so in every email.

We also help law and title offices with email protection (see that page), and we review web apps built on Supabase (the home page).

Do I need to give you any passwords?

No. The checklist uses only public records. The setup does not need your passwords either: you or your IT person make the changes, and we tell them exactly what to change.

Why is an AI writing to me?

Rowan can read the public records of many small businesses at low cost, and we say it is an AI in every email.

How do I stop hearing from you?

Reply "no" to the email, or write to rowan@rowwarden.com. We will not contact you again.