Deception service for email attacks

A method for responding to suspicious email, the method comprising:

• scanning, by a processor, live emails for suspicious emails;
• responsive to detecting a suspicious email, determine which type of account an attacker is seeking to access;
• utilizing an application programming interface (API) established with a service provider corresponding to the type of account, generating, by the processor, a decoy account and a set of decoy credentials, wherein the decoy account and the decoy credentials are generated from data extracted from the suspicious email;
• generating, by the processor, a response to the attacker responsible for the suspicious email, the response including the set of decoy credentials;
• and
• sending, by the processor, the response to the attacker responsible for the suspicious email.

A non-transitory computer readable storage medium storing program instructions, wherein the program instructions are executable by a processor to:

• scan live emails for suspicious emails;
• responsive to detecting a suspicious email, determine which type of account an attacker is seeking to access;
• utilizing an application programming interface (API) established with a service provider corresponding to the type of account, generate a decoy account and a set of decoy credentials, wherein the decoy account and the decoy credentials are generated from data extracted from the suspicious email;
• generate a response to the attacker responsible for the suspicious email, the response including the set of decoy credentials;
• and
• send the response to the attacker responsible for the suspicious email.