Email security based on display name and address

A system comprising:

• one or more hardware processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
• receiving an email for a user account registered with an email service, the user account being associated with a first domain name of a first party;
• extracting, from the email, a sender name and a sender address associated with a sender of the email, the sender name being associated with a name in a registry or list of names associated with the first party;
• comparing, by an email security platform, the sender name with the sender address, the sender address comprising a second domain name of a second party being different than the first party;
• generating, by the email security platform, a similarity value based on a result of the sender name being compared with the sender address;
• determining, by the email security platform, that the email comprises the sender name impersonating a name of the sender, based on the similarity value meeting or exceeding a threshold value indicative of impersonation;
• and
• deleting or quarantining the email from an inbox associated with the user account, based on the similarity value meeting or exceeding the threshold value.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving an email for a user account registered with an email service;
• extracting, from the email, a sender name and a sender address associated with a sender of the email;
• comparing, by an email security platform, the sender name with the sender address;
• generating, by the email security platform, a similarity value based on a result of the sender name being compared with the sender address;
• determining, by the email security platform, that the email comprises the sender name impersonating a name of the sender, based on a difference between the similarity value and a threshold value;
• normalizing and scaling the difference, as a modified difference;
• determining a confidence score associated with the modified difference;
• and
• deleting or quarantining the email from an inbox associated with the user account, based on the confidence score being indicative of impersonation.