THE FULL TOUR

Every layer of RILLA Shield, in one place.

You've seen the homepage. Here's the depth underneath it — the detection engine, the AI that acts, the supplier vault, the payment controls, the cryptographic evidence chain and the platform-level bodyguard that keeps it all safe.

01

Auto-scan runs the gatekeeper while you work

Connect your inbox or accounting system once. RILLA checks every invoice, bank-detail change and supplier message before payday — and texts you the moment something's off. Manual scan is always there when you want to check something yourself.

Auto-scan

ALWAYS ON

Runs every 5 minutes across Gmail, Outlook, Xero, MYOB and forwarded SMS. Flags scams the instant they land — before you open them.

  • Inbox + accounting + SMS monitored continuously
  • In-app, email and SMS alerts on high risk
  • Set-and-forget — no daily login required
Open auto-scan

Manual scan

ON DEMAND

Tap Scan Now anytime — paste an email, drop a PDF, snap a photo or check a phone number. Full risk verdict in seconds.

  • Invoices, PDFs, screenshots, pasted text
  • Phone, ABN and BSB lookups
  • Full reasons + recommended next action
Open manual scan

RILLA Agent

WATCHDOG

A live agent watches every supplier, bank detail and recent scan, surfacing the risks that need action before you sit down to pay.

  • Detects bank-detail changes across suppliers
  • Surfaces stale 'verify' holds after 3 days
  • Warns on brand-new suppliers sending large first bills
02

One engine. Twenty-one layers. Every scam type.

RILLA doesn't rely on a single signal. Twenty-one deterministic layers — from ABN/GST validation to domain reputation to behavioural drift — feed the AI reasoner, so a verdict is always backed by explainable evidence, not a black box.

22 detection layers

FULL CHAIN

SMS → email → invoice → ABN/BSB → ABA → pay-run hold. The only engine covering the entire payment fraud chain in one pass.

  • Payment redirection & changed bank details
  • Spoofed domains, phishing links, sender impersonation
  • Altered invoices, missing ABN, duplicates, GST anomalies

Multi-model AI consensus

NO BLACK BOX

Each scan runs across multiple AI models. You see their level of agreement — unanimous, majority or split. Split verdicts force a mandatory verify step.

  • Consensus badge on every result
  • Split verdicts trigger extra verification
  • Full model card at /trust/model-card

Supplier behavioural fingerprint

DRIFT DETECTION

RILLA learns each supplier's habits — invoice naming, GST patterns, sending cadence. When behaviour drifts, you get a high-severity alert before the money moves.

  • Invoice naming & structure fingerprinting
  • GST and amount-pattern baselines
  • Drift scoring after 3 documents per supplier

Document DNA

FORGERY DETECTION

Every scanned invoice builds a technical fingerprint — metadata, structure, signature patterns. After three documents, forged or re-templated invoices get caught automatically.

  • PDF skeleton fingerprinting
  • Baseline after 3 documents
  • Template-deviation alerts
03

Lock, verify and remember every supplier you pay

The four defences that stop the scams that slip through the gaps — account takeovers, forged invoices, and fake batch payments.

Verified Supplier Vault

IMMUTABLE LOCK

Store trusted supplier bank details in a locked vault. Any change triggers an SMS OTP to your verified mobile — a stolen password alone can't repoint a supplier to a mule account.

  • OTP-protected lock/unlock
  • Account-takeover protection
  • Full audit log of every change
Open verified supplier vault

Reverse Invoice Matcher

SMS VERIFY

Before you pay a new or changed supplier, we text their known-good mobile with the BSB/account details. A 'NO' reply fires an instant critical alert — stopping social-engineering scams before money moves.

  • Out-of-band SMS confirmation
  • Instant alert on 'NO' replies
  • Last-4-only masked account details
Open reverse invoice matcher

ABA File Checker

BATCH PAY

Upload your ABA payment batch and cross-check every destination account against the vault, known-good suppliers and risk signals before the pay-run leaves your bank.

  • Batch-level account validation
  • Vault mismatch warnings
  • Pay-run freeze on critical hits
Open aba file checker

Supplier memory

LONGITUDINAL

RILLA remembers every supplier you've paid. If their bank details change between invoices, you get a high-severity alert — the #1 signal of business email compromise.

  • BSB, account, ABN and domain change detection
  • New-supplier sanity checks
  • Per-supplier history view
04

Autonomous AI that reasons, reconciles and investigates

Beyond detection — RILLA's AI layer acts. It reconciles pay runs, interrogates risk, traces attack chains and clusters fraud rings, then writes a board-ready brief every week.

Autonomous pay-run reconciliation

AUTO

AI-driven Pay / Verify / Hold verdicts on every ABA batch, reconciling against the vault, supplier history and network signals — automatically, before the batch is released.

  • Per-item verdicts on ABA batches
  • Auto-hold on critical items
  • Reconciliation trail for audit

AI Risk Interrogator

ASK ANYTHING

Ask any scan 'why?' in plain English. The interrogator walks you through every signal, every layer and the model agreement behind the verdict.

  • Plain-English risk explanations
  • Signal-by-signal breakdown
  • Board-safe reasoning trail
Open ai risk interrogator

Attack-chain forensics

TRACE

Reconstructs the full path an attack took — from the first spoofed email to the bank-detail swap — so you can see exactly how it happened and close the gap.

  • End-to-end attack reconstruction
  • Timeline of every signal
  • Gap-closing recommendations
Open attack-chain forensics

Fraud-ring detection

NETWORK

Clusters related scams across the RILLA network — shared mule accounts, lookalike domains, repeated invoice templates — to expose coordinated fraud rings before they reach you.

  • Shared-account clustering
  • Lookalike-domain grouping
  • Cross-business ring alerts
Open fraud-ring detection

AI Executive Risk Brief

WEEKLY

Every week RILLA writes a board-ready CFO narrative — dollars protected, top risks, pay-run verdicts and recommended actions — auto-generated and delivered.

  • Auto-generated weekly
  • Board-safe language
  • Delivered to your inbox
Open ai executive risk brief
05

The Circuit Breaker — one gate, one verdict

All controls feed a single release verdict. Nothing fights itself. Critical risks auto-freeze the pay-run; a break-glass override exists for emergencies, drilled and logged.

Circuit Breaker

SINGLE VERDICT

One gate decides whether a payment releases. Every control — vault, fingerprint, network, AI — feeds it as a signal. No conflicting alerts, no decision paralysis.

  • Single release / hold / freeze verdict
  • Break-glass override for emergencies
  • Every override drilled and audit-logged

Pay Freeze panic button

INSTANT

One tap freezes every outbound payment across connected accounts. Releasing requires verified re-authorisation — your emergency stop for a suspected breach.

  • Instant freeze across all accounts
  • Verified re-authorisation to release
  • Full audit trail of every freeze

Verified Pay-Run

BANK-READY

Before a batch leaves your bank, RILLA verifies every payee against the vault, the network and the AI verdict — and signs the run with a cryptographic attestation.

  • Per-item verification before release
  • Signed pay-run attestation
  • Bank and ERP verifiable
06

Cryptographic proof, not just a log

Banks and underwriters ask for proof a verdict existed, unaltered, on the date recorded. RILLA's tamper-evident hash chain and daily signed Merkle roots deliver exactly that — provable even against RILLA itself.

Tamper-evident audit chain

HASH-CHAINED

Every audit event is chained with SHA-256 and keyed HMAC. Any later edit or insert breaks the chain and is flagged. A stolen DB password still can't forge a valid row.

  • Hash-chained from genesis
  • HMAC-signed chain links
  • Tamper detection even with DB write access

Daily evidence seal

MERKLE ROOT

Every night at 00:20 UTC the day's audit records fold into a signed Ed25519 Merkle root. Anchors are public and verifiable — proof a verdict existed, unaltered, on its date.

  • Daily Ed25519-signed Merkle root
  • Public verification at /trust/evidence
  • Provable even against RILLA itself
Open daily evidence seal

Bank-ready evidence pack

PDF EXPORT

Every scan exports as a signed PDF evidence pack formatted for CommBank, NAB, Westpac and ANZ fraud-team intake — verified facts, flags and the full AI reasoning trail.

  • One-tap signed PDF export
  • Bank fraud-team intake format
  • Includes full reasoning trail
07

RILLA Sentinel — the app's own bodyguard

A request-level gatekeeper that inspects every incoming request for injection, path traversal and honeypot probes, auto-bans hostile sources, and runs alongside MFA, key rotation and the network trust layer.

RILLA Sentinel

GATEKEEPER

Inspects every request for SQL/XSS injection, path traversal and honeypot probes. Auto-bans hostile sources (600 req/min or signature match) at the edge.

  • Injection & traversal detection
  • Auto-ban for hostile sources
  • Edge-level request inspection
Open rilla sentinel

2FA & step-up auth

MFA

Every account supports two-factor auth, with step-up verification on sensitive actions — bank-detail changes, pay-run releases and admin overrides.

  • 2FA on every account
  • Step-up on sensitive actions
  • Known-device fingerprinting

RILLA Network trust

CROSS-BUSINESS

Every scan shows how the wider network sees this payee — trusted, known, new or flagged — using hashed signals only, never PII. Dozens of safe payments = trust.

  • Network-level payee trust
  • Hashed signals, no PII
  • Trusted / known / new / flagged tiers

MCP server

AGENT-NATIVE

Any AI assistant that speaks Model Context Protocol — Claude, ChatGPT, Cursor — can call RILLA's fraud checks directly. RILLA inside the tools you already use.

  • OAuth 2.1 protected endpoint
  • ABN, BSB, invoice & email forensics tools
  • Copy-paste connect at /docs/mcp
Open mcp server

AU-hosted & audit-ready

SOVEREIGN

Data stays on Australian infrastructure. Full audit trail, signed forensic reports on request, and a trust pack open for your bank, insurer or auditor to review.

  • Australian-hosted data
  • Full audit trail export
  • Open trust pack for auditors
Open au-hosted & audit-ready

That's the depth. Now put it to work.

Connect once and the whole stack runs automatically — or scan a single invoice right now, free.

© 2026 Rilla Shield Defence Pty Ltd · ABN 80 678 733 950 · Content protected by trademark — see Copyright & IP Notice.