Classifying a message based on fraud indicators

A system for classifying a message, comprising:

• a memory;
• a communications interface, wherein the communications interface receives the message over a communications network;
• a processor, wherein the processor executes instructions stored in memory to:
• extract a plurality of reference points from a body of the message, each reference point being information used to contact a referenced entity;
• classify each of the plurality of reference points based on a source associated with each reference point;
• determine whether the message is a fraudulent message appearing to be from a legitimate source based on the classified reference points;
• and
• process the message based on the determination of whether the message is a fraudulent message appearing to be from a legitimate source.