Abstract: A method of classifying electronic communications includes receiving an electronic message. A whitelist is input comprising at least one entry associated with an authoritative entity. At least one similarity score is computed based on an extent to which the message matches the entry in the whitelist. When the similarity score exceeds that threshold value, an indicator is output of a risk that the message appears to be associated with the authoritative entity. It is determined whether the message was sent from the authoritative entity based on at least one of attempting to verify an email authentication, and comparing an email address of a sender of the message to an email address associated with the authoritative entity. Responsive to determining that the message was sent from the authoritative entity, the message is delivered. Responsive to determining that the message was not sent from the authoritative entity, a security action is performed.

Abstract: A system and method for detection of email risk automatically is disclosed.

Abstract: A system for detection of email risk automatically determines that a first party is considered by the system to be trusted by a second party, based on at least one of determining that the first party is on a whitelist and that the first party is in an address book associated with the second party. A message addressed to the second party from a third party is received. A risk determination of the message is performed by determining whether the message comprises a hyperlink and by determining whether a display name of the first party and a display name of third party are the same or that a domain name of the first party and a domain name of the third party are similar, wherein similarity is determined based on having a string distance below a first threshold or being conceptually similar based on a list of conceptually similar character strings.

Abstract: A system for detection of email risk automatically determines that a first party is considered by the system to be trusted by a second party, based on at least one of determining that the first party is on a whitelist and that the first party is in an address book associated with the second party. A message addressed to the second party from a third party is received. A risk determination of the message is performed by determining whether the message comprises a hyperlink and by determining whether a display name of the first party and a display name of third party are the same or that a domain name of the first party and a domain name of the third party are similar, wherein similarity is determined based on having a string distance below a first threshold or being conceptually similar based on a list of conceptually similar character strings.

Abstract: Detecting scam is disclosed. A sender, having a first email address, is associated with a set of secondary contact data items. The set of secondary contact data items comprises at least one of a phone number, a second email address, and an instant messaging identifier. It is determined that an email message purporting to originate from the sender's first email address has been sent to a recipient. Prior to allowing access by the recipient to the email message, it is requested, using at least one secondary contact item, that the sender confirm that the email message was indeed originated by the sender. In response to receiving a confirmation from the sender that the sender did originate the email message, the email message is delivered to the recipient.

Abstract: Classifying electronic communications is disclosed. An electronic communication is received. A first likelihood that a potential recipient of the electronic communication would conclude that the communication was transmitted on behalf of an authoritative entity is determined. An assessment of a second likelihood that the received communication was transmitted with authorization from the purported authoritative entity is performed. The electronic communication is classified based at least in part on the first and second likelihoods.

Abstract: Information associated with a plurality of electronic communications between a first entity and a second entity is obtained. First and second determinations are performed that the number of communications in the plurality of electronic communications exceeds a first threshold, and that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold. A classification is performed on a received electronic communication based at least in part on the first determination and the second determination, the electronic communication is assigned one of three different classifications: good, bad, and undetermined. At least one action is performed based at least in part on the performed classification.

Abstract: Classifying electronic communications is disclosed. An electronic communication is received. A first likelihood that a potential recipient of the electronic communication would conclude that the communication was transmitted on behalf of an authoritative entity is determined. An assessment of a second likelihood that the received communication was transmitted with authorization from the purported authoritative entity is performed. The electronic communication is classified based at least in part on the first and second liklihoods.

Abstract: Information associated with a plurality of electronic communications associated with an entity is obtained. An entry including information associated with a given email address is generated in a whitelist. The entry including the information associated with the given email address is generated based at least in part on a determination, from the obtained information associated with the plurality of electronic communication associated with the entity, that at least a threshold number of electronic communications have been exchanged between the entity and the given email address, and that the at least threshold number of emails were exchanged during a period of time that exceeds a threshold period of time. Subsequent to generating the whitelist entry, an electronic communication to be classified is received. A classification of the received electronic communication is performed based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist.

Abstract: Information associated with a plurality of electronic communications between a first entity and a second entity is obtained. First and second determinations are performed that the number of communications in the plurality of electronic communications exceeds a first threshold, and that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold. A classification is performed on a received electronic communication based at least in part on the first determination and the second determination, the electronic communication is assigned one of three different classifications: good, bad, and undetermined. At least one action is performed based at least in part on the performed classification.

Abstract: An electronic communication is received. The received communication is classified according to a tertiary classification scheme. In the tertiary classification scheme, communications classified using a first classification are not delivered to a recipient. Also in the tertiary classification scheme, communications classified using a second classification are subjected to heightened review. In some cases, the heightened review is performed by one or more reviewers, after the communication has been at least partially redacted.

Abstract: Classification of electronic communications includes receiving an electronic communication, evaluating the received communication against a collection of terms, and classifying the received communication based at least in part on the evaluation. The collection of terms is representative of a particular strategy of an attacker. The evaluation includes determining a presence of a portion of the collection of terms in the electronic communication.