Tender Fraud Prevention User Manual

Last updated: 6 July 2026

Tender Fraud Prevention is a South African tender-fraud verification service. It checks suspicious emails, tender requests and quote documents for the signs of procurement fraud, gives you a clear risk score, and lets you report and track fraud across the country. This guide walks through every part of the product in plain steps.

A quick map of how to use this manual: the table of contents on the side jumps you to any section. If you only want one thing, the most common task is Verify a suspicious email.

What Tender Fraud Prevention is#

At a glance: an AI-assisted fraud checker built for South African procurement. Paste an email or upload a tender document, and within seconds you get a 0 to 100 risk score, a verdict, and the specific red flags that drove it.

Tender Fraud Prevention looks for the patterns behind tender and RFQ scams: spoofed government domains, fake supplier quotes, phantom companies, inflated pricing, and phishing aimed at procurement staff. It draws on official South African data sources and a growing fraud-intelligence database, then explains its reasoning so you can decide what to do next.

Three things to know before you start:

• Much of Tender Fraud Prevention is open to everyone, with no account needed. You can verify emails, analyse documents, browse the public fraud feed and map, and report fraud without signing in.
• An account adds the dashboard: billing, your team, a watchlist, notification settings and API access.
• Tender Fraud Prevention gives you evidence and a recommendation. It does not make the final call for you. When a result is uncertain, it tells you so and suggests how to confirm.

Getting started#

At a glance: start verifying straight away without an account. Sign in when you need the account dashboard or higher monthly limits.

Using Tender Fraud Prevention without an account#

You can do all of the following without logging in:

1. Verify a suspicious email or sender domain.
2. Analyse a tender PDF or quote document.
3. Browse the public fraud feed and the live fraud map.
4. Report a fraud attempt.

The free Starter plan covers 20 email verifications a month. Higher volumes and team features need a paid plan.

Signing in#

To reach your account dashboard, open the sign-in screen at /login.

1. Enter your Email address.
2. Enter your Password.
3. Tick Remember me for 30 days if you are on a trusted device.
4. Click Sign in.

If your account has two-factor authentication switched on, you are asked for a 6-digit code from your authenticator app before you reach the dashboard.

To get onto a paid plan, open the pricing page and choose a plan. Team members are normally added by their organisation's account admin, who sends an invite by email (the invite link is valid for 48 hours).

If you forget your password#

1. On the sign-in screen, click Forgot password?.
2. Enter your email address and submit.
3. Check your inbox for a reset link and follow it to set a new password.

If the email does not arrive within a few minutes, check your spam folder, then try again.

Plans and pricing#

At a glance: four plans, priced in rand. Start free, or start a 14-day trial on a paid plan with no card required. Annual billing saves 20%.

Open the pricing page to compare plans and switch between monthly and annual billing with the toggle at the top.

Business is marked as the most popular plan. To start, click Start free (Starter), Start 14-day trial (Professional or Business), or Contact sales (Enterprise). You can change plans later: upgrades apply immediately and are prorated, downgrades take effect at the next billing cycle. All data is hosted in the af-south-1 (Cape Town) region.

Verify a suspicious email#

At a glance: paste the sender's address or the email itself, run one of four analysers, and read the 0 to 100 risk score and verdict. This is the core of Tender Fraud Prevention and needs no account.

Open the home page and click Verify Now (or Verify Email in the menu) to jump to the verification panel, or go straight to /verify. The panel has tabs across the top, one for each kind of check.

Step by step#

1. Choose the tab that matches what you have. Verify Address is the default and the fastest check.
2. Type or paste the value into the box. For Verify Address, enter the sender's email, for example tenders@treasury.gov.za.
3. Click the action button (Verify Email on the address tab). It changes to Verifying... while the check runs.
4. Watch the short analysing screen. It shows each step as it completes and a preview of the email being scanned.
5. Read the result card: the verdict, the risk score, and the detailed panels explaining what was found.

Privacy note: content you submit for analysis is processed by our AI analyst and kept in our fraud-intelligence logs to improve detection. Do not paste anything you are not comfortable sharing for that purpose.

The analysers#

Tender Fraud Prevention offers several analysers, each shown as a tab:

• Verify Address. Checks whether the sender's domain matches an official South African government domain. Quick and useful as a first pass on any RFQ that claims to be from a department.
• Analyze Content. Paste the body of the email. The AI looks for the language patterns of procurement fraud: false urgency, banking-detail changes, requests for upfront samples or payments, and similar tactics.
• Analyze Header. Paste the email's raw headers. The check inspects the routing path and the authentication results (SPF, DKIM and DMARC) to see whether the sender is who they claim to be.
• Phishing Check. Paste the email to scan for phishing tactics, a linguistic fingerprint, and suspicious links.
• Batch. Upload several files at once. See Batch upload.

For the content, header and phishing tabs, paste the relevant text and click the matching button (Analyze Content, Analyze Header, or Analyze for Phishing).

Reading the risk score and verdict#

Every check returns a risk score from 0 to 100. Higher means more likely to be fraudulent. The score comes with a plain-language verdict and a risk band.

For the Verify Address check, the verdict is one of:

For the content and phishing checks, the result is shown as a risk band:

A green or "legitimate" result lowers the odds of fraud but is never a guarantee. Always confirm banking-detail changes by phoning a number you already have on file, never a number from the email itself.

When a result is inconclusive#

If the AI is not confident enough either way, you see an inconclusive card headed We can't confidently call this one, with a confidence gauge and a split of the legitimate and suspicious signals it found.

It then recommends four steps:

1. Call the sender on a phone number from your own records, not one in the email.
2. Cross-check the tender reference on etenders.gov.za.
3. Forward the email, with its full headers, to verify@tenderfraud.co.za for an intelligence review.
4. Do not click any links or reply until you have confirmed the sender.

You can also expand AI analysis details to see the raw reasoning, or submit a fraud report from here.

Checking a domain#

There is no separate domain-search page, but you can check a domain directly: enter it (or any address at that domain) on the Verify Address tab and run the check. The result tells you whether the domain is an official government domain or not.

Analyse a tender document or attachment#

At a glance: upload a tender PDF, RFQ or quote and get a forensic report with a risk score, extracted line items and contacts, market price checks, and a list of red flags. You can export the whole report as a PDF.

Document forensics is available on the Professional plan and above.

Uploading a file#

1. Open the attachment forensics panel.
2. Drag a file onto the upload box, or click it to choose a file.
3. Accepted file types are PDF, DOC, DOCX, TXT, JPG, JPEG and PNG. The maximum size is shown on the upload box.
4. The analysis runs through several stages, which you can watch on the timeline. If you have analysed the same file before, the result loads instantly from cache and no new analysis is run.

Reading the forensic report#

The report is laid out top to bottom, with the most important parts first:

1. Security verdict and risk gauge (the 0 to 100 score).
2. Executive summary in plain language.
3. Market intelligence (see below).
4. Quoted vs market price comparison, when price data is available.
5. Line items extracted from the document: description, model, quantity, unit price and line total. These are copied straight from the document.
6. Document forensic metadata, such as the author and the software used to create the file.
7. RFQ forensic metadata, such as the reference number and scope of work.
8. Product features and specifications.
9. Extracted information: department or company, requestor, and the contact name, phone and email found in the document.
10. Product and supplier analysis: how common the product is, and whether it points to a single, possibly phantom, supplier.
11. Security red flags: a list of the specific warning signs found.
12. Analysis timeline showing how long each stage took.

Market intelligence and price checks#

The Market intelligence section tells you how widely available the quoted product is on the open market and lists the sources it found. A product with almost no market presence is a common sign of a phantom supplier.

When the document contains prices, the Quoted vs market section compares the quoted price against the market median, shows the percentage difference, and links to the price sources. A large gap above the market price is a red flag.

Exporting a PDF report#

To save or share the report, click Export PDF. This produces a formatted forensic report (risk score, summary, extracted information, supplier analysis, market intelligence and red flags), named in the pattern TFSAV2_Forensic_Report_<reference>_<date>.pdf.

Batch upload#

At a glance: check many tender PDFs in one go and see all their risk scores side by side. Available on the Business plan.

1. Open the batch panel (the Batch tab on the verification page, or the batch upload section).
2. Drop your PDFs onto the box. The number of files allowed per batch is shown on the page.
3. Files are analysed one after another. Each row updates as it finishes, showing the risk score, the product extracted, and the department.
4. Status icons tell you what is happening with each file: processing, complete, loaded from cache, pending, or failed.
5. When the batch is done, you see a summary: how many files fall into each risk band, the median score, and a running tally of completed, processing, pending, failed and cached files.
6. Export everything with Export combined PDF, or export the table to CSV.

How to read red flags#

At a glance: a short checklist of the signs that an RFQ or tender email is fake. Tender Fraud Prevention looks for these automatically, but knowing them helps you spot fraud yourself.

The common warning signs are:

• Look-alike domains, for example @treasury.gov-za.org instead of the real @treasury.gov.za.
• RFQs sent from free Gmail or Outlook accounts rather than an official department domain.
• Requests for an immediate "sample" payment.
• Incorrect or low-resolution department logos.
• Urgent demands to change banking details.

In a forensic report, red flags also include intelligence-database hits (the entity is already known to us), metadata fraud indicators (the file's hidden properties do not match its claims), and phantom-supplier indicators (a supplier with almost no real market footprint).

When you see any of these, slow down and confirm through a channel you trust before acting.

Public fraud intelligence#

At a glance: open, anonymised views of fraud activity across South Africa. No account needed.

Recent Alerts#

On the home page, the Recent Alerts section shows a snapshot of recent fraud-detection alerts across government procurement: a short title, the department, a severity badge (high, medium or low) and the amount involved. It gives you a feel for the kinds of fraud being caught.

Fraud Feed#

The fraud feed at /fraud-feed is a live, anonymised stream of verification activity. Each entry shows a timestamp, a short summary of the event, a risk band and score, and sometimes a department.

How to use it:

• Use Filter by risk level to show only Very high, High, Medium, Low or Verified entries.
• Toggle Auto-refresh on or off, and Pause or Resume the stream.
• Click View full historical feed for the complete record.

Everything in the feed is anonymised to protect people and comply with POPIA: recipient email addresses are blacked out, IP addresses are reduced to a provincial centre, personal names never appear, sender domains show only if already blocked or reported by several users, and the data is delayed by 30 seconds.

Further down the same page, a How tender scams work section breaks down real fraud techniques into short cards: a title, a severity badge (very high, high, medium or low), a plain-language description of the technique, sometimes a redacted excerpt of real wording fraudsters use, and the specific red flags that give it away. Examples are anonymised and curated by the intelligence team, so this section only appears once cards are available.

Live Map#

The live map at /live-map plots reported fraud activity across the nine provinces. Colour shows the activity band for an area, and the size of each area reflects how many incidents it has.

How to use it:

1. Pick a time window: last 24 hours, 7 days, 30 days or 90 days.
2. Filter by severity, or click provinces to focus on them, then click Apply filters.
3. Click a province to see its incident count, severity and time window.
4. Read the Activity Legend: a red dot is high reported activity for that area, gold is elevated, and slate is low.
5. Use Export GeoJSON to download the visible data, or Embed map to copy an embed snippet.

The map uses the same anonymisation as the feed: IP addresses are aggregated to a provincial centre and personal identities are removed. It shows area-level activity volumes only — it never names a domain or an organisation, and it never labels anything on the map as confirmed fraud.

Reporting fraud#

At a glance: report a suspected scam in a couple of minutes. You get a reference number and a 48-hour review commitment.

Open the report form at /contact.

1. Choose the Type of fraud (ghost supplier, price gouging, bid rigging, impersonation, forged EPP, or other). Optional.
2. Set When did this occur?. Optional.
3. Enter the Suspicious email address. Required.
4. Enter Your email address if you want updates. Optional.
5. Describe what happened. Timelines, amounts and exact wording all help.
6. Tick the box if the fraud is ongoing and needs immediate intervention.
7. Answer the short security question (a simple sum) to prove you are human.
8. Click Submit report.

You can save a draft and come back later. After submitting, you see a Report received screen with a reference number in the form TFR-2026-NNNNN. The intelligence team reviews submissions within 48 hours, and you are updated at the email you provided.

For fraud in progress, the confirmation screen lists emergency numbers: SAPS 10111 and the SAFPS Fraud Hotline 0860 101 248.

Your account#

At a glance: once you are signed in, the account dashboard holds your profile, security, notifications, billing, team, watchlist and API access. Reach it from the Account link in the menu.

Profile#

Edit your personal details: first and last name, display name, phone, time zone and language. You can upload a profile photo (PNG or JPG, up to 2 MB) with Upload new, or Remove it. Click Save changes to keep your edits, or Cancel to discard them. A sidebar shows your account status, your current subscription and how much of your monthly quota you have used.

Security and two-factor authentication#

The security tab is where you protect your account:

• Change password. Click Change password. The page shows when it was last changed.
• Two-factor authentication (2FA). Set up an authenticator app (TOTP), or a hardware security key or SMS as alternatives. The steps are: choose a method, scan the QR code and enter the 6-digit code, then save your backup codes. Click Verify and enable. Once on, you can Disable it again from the same place.
• Active sessions. See every device signed in to your account, with its location and last-active time. Your current device is marked This device. Use Revoke to sign out one device, or Sign out of all other sessions to clear the rest.
• Sign-in alerts. Choose to be emailed about unusual sign-ins, new devices, or every sign-in.
• Audit log. Use Download my audit log to get a record of account activity.

Turning on two-factor authentication is the single best step you can take to keep your account safe.

Notifications#

Decide how and when Tender Fraud Prevention contacts you. You control three channels (email, SMS and in-app push) and can switch each event on or off per channel. Events include a completed verification, a verification flagged as fraudulent, a saved pattern match, the weekly fraud digest, sign-ins from new devices, team invites, invoices, and subscription-expiry reminders. Use Test push to confirm in-app notifications work on your device.

Billing and invoices#

The billing tab shows your current plan, its price, your next renewal date and how much of your monthly verification quota you have used.

• Change plan. Click Change plan to compare tiers and switch.
• Cancel subscription. Click Cancel subscription to stop auto-renewal.
• Payment methods. See your saved cards, edit or remove them, or click Add payment method.

Your invoices are listed with their number, date, amount and status. Each one has a download button, and you can use Export all (CSV) for the full set. Open an invoice to see the full tax invoice, then use Download PDF to save it or Email a copy to send it. Invoices include VAT and are retained for SARS compliance.

Team and seats#

If your plan includes team seats, the team tab shows how many seats you have used and lists every member with their role and status.

• Invite a member. Click Invite member, enter one or more email addresses, choose a role, and click Send invite. Invitees get an email with a link that is valid for 48 hours.
• Roles. Admin (full access, including billing and API keys), Analyst (run verifications and hold their own API keys, but no billing), Viewer (read-only, capped at 50 verifications a month), and Billing (billing only, cannot run verifications).
• Manage members. Change a member's role or remove them from the actions menu. You cannot change your own role or remove yourself.
• Pending invites. Resend or revoke invites that have not been accepted yet.

Watchlist#

The watchlist tracks domains and addresses you have already verified as legitimate, and warns you (here and by email) if one of them later turns up in fraud activity.

1. Choose Domain or Email.
2. Enter the value, for example treasury.gov.za.
3. Click Add to watchlist.

Each entry shows whether it is still Cleared or has been Flagged. Remove an entry with its delete button. This is a good way to keep an eye on the suppliers and departments you deal with most.

API access and keys#

Tender Fraud Prevention has a REST API with webhooks, available on the Professional plan and above. The public API documentation at /api-docs lists the endpoints (including a domain-reputation lookup), authentication, rate limits and SDKs.

API requests use a bearer token on the Authorization header. API keys are created and rotated from the admin area of your account, scoped per environment. Use restricted keys for anything that runs in a browser, keep server keys server-side, and rotate keys regularly.

Your data and privacy (POPIA)#

At a glance: you can ask for a copy of your data, fix it, or have it deleted. Tender Fraud Prevention handles these requests under POPIA.

Export, correct, or delete your data#

Open the data-request form at /dsar. You can make four kinds of request:

To submit a request:

1. Confirm your identity. If you are signed in, this is done from your session. If not, you upload an ID or passport and confirm by email.
2. Choose which categories of data the request covers (profile, verification history, audit trail, billing invoices, support history).
3. Optionally set a date range and a preferred format (CSV, JSON or a PDF summary).
4. Tick the confirmation that you are the data subject, and click Submit request.

Requests are acknowledged within 3 business days and answered within 30 days, free of charge for up to two requests a year. Audit entries are kept for seven years in line with POPIA, but are pseudonymised. To appeal a decision, email privacy@tenderfraud.co.za.

Getting help#

At a glance: reach a person when you need one.

• General support and questions: info@tenderfraud.co.za.
• Have an inconclusive result reviewed by the intelligence team: forward the email with its full headers to verify@tenderfraud.co.za.
• Privacy and data requests: privacy@tenderfraud.co.za.
• Fraud in progress: call SAPS 10111 or the SAFPS Fraud Hotline on 0860 101 248.

You can also check the system status page to see whether the service is running normally, and the what's new page for recent changes. To report a scam at any time, use the report form.