Abstract: Identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source. An authentic writing style contained within a legitimate electronic message that originates from a vender may be identified. The authentic writing style may be stored in a database. A new electronic message may be received that appears to originate from the vendor. The new electronic message may contain a new writing style. The new writing style may be compared with the authentic writing style stored in the database to identify any differences between the new writing style and the authentic writing style. A determination may be made that the new electronic message does not originate from the vender based, at least on part, on one or more differences identified between the writing styles. A security action may then be performed to protect against the new electronic message.