Common attacks we see:

• Executive impersonation requesting wire transfers
• Fake HR emails changing payroll / direct deposit
• Credential phishing disguised as Microsoft or DocuSign
• Vendor fraud from lookalike domains
• Thread hijacking — inserting into real email chains
• A simple percentage score with a color
• One plain-English sentence explaining the concern
• Detailed checks listed with red flags at the top
• Three clear steps telling the user what to do

What we kept hearing:

“Is this a real email?”

“I wasn’t sure, so I just ignored it.”

“It looked legit to me.”

“Why didn’t the spam filter catch it?”

34

safety checks

0

local installs

1–3s

analysis time

0

data collected

1

Open any email in Outlook — the add-in loads automatically

2

A safety score (0–100%) appears with a color-coded verdict

3

An ALERT line gives you the plain-English reason for any concerns

4

Detailed check results are listed below, red flags first

5

Three clear action steps tell you exactly what to do next

90–100%

✅ Looks Legitimate

Passes all checks — no action needed

75–89%

🟡 Mostly Safe

Minor concern — use your judgment

55–74%

⚠️ Proceed with Caution

Review before responding or clicking links

35–54%

⛔ Suspicious Email

Verify the sender by phone before acting

0–34%

🚨 Likely Phishing

Do not engage — report as phishing

📧 Payroll Diversion Attempt

An employee received an email appearing to be from a colleague, asking to update their direct deposit information before the next payroll cycle. The display name matched the colleague's name — but the email came from an unrelated domain with a generic username. The add-in flagged it: name doesn't match username, financial request detected, and showed the combined alert PAYROLL DIVERSION RISK. The employee called HR to verify — the colleague had never sent it. Fraud prevented.

📧 Company Impersonation (BEC)

An email arrived claiming to be from a well-known company, requesting a callback for an 'urgent service requirement.' The display name looked legitimate. But the sender domain was completely unrelated, the body directed replies to a third domain, and the email contained 10 BEC language patterns. Score: 5% — Likely Phishing. The add-in showed a PAYROLL DIVERSION RISK combined alert. No response was sent.

📧 Mass Phishing Campaign (Slipped Past Spam Filter)

An email arrived with a professional layout, a PDF attachment labeled 'Statement,' and a button reading 'Access Secure File.' The sending domain was foreign (.com.au), the username was randomly generated, and the greeting said 'System User' instead of the recipient's name. The spam filter passed it. The add-in caught it: foreign domain, random username, impersonal greeting, and a MASS PHISHING PATTERN alert. Score: approximately 1%.

✅ Correctly Cleared — Legitimate CFO Email

A nonprofit's CFO sent a routine reply about a laptop repair. An early version of the add-in flagged it — her title in the email signature triggered 'authority language,' and the IT technician's email in the quoted reply chain triggered a contact mismatch. We fixed this by teaching the add-in to strip signatures, reply headers, and CAUTION banners before analyzing content. The email now scores 100%.

Every result includes:

The three action steps shown every time:

1. Were you expecting this email?

Use your best judgment if the sender is familiar.

2. If you know them — call and confirm.

Use a known number, not one from the email.

3. If you don't recognize them — delete it.

Report using the Report button in Outlook.

🔒 The only external request

The sender's domain name (e.g. example.com) is looked up against a public registration database (equivalent to a WHOIS search). No email content, personal data, or identifying information ever leaves your machine. Results are cached locally for 24 hours so the same domain is never looked up twice in a day.