Detecting of business email compromise

A system for determining whether an electronic message is deceptive, comprising:

• a processor configured to:
• automatically determine whether a first party is considered trusted by a second party, based on at least on one of determining that the first party is on a whitelist and that the first party is in an address book associated with the second party;
• receive a message addressed to the second party from a third party;
• determine if the received message poses a risk by determining that a display name of the first party and a display name of third party are the same or that a domain name of the first party and a domain name of the third party are similar, wherein similarity is determined based on having a string distance below a first threshold or being conceptually similar based on a list of conceptually similar character strings;
• responsive to the first party is considered trusted by the second party, and the received message is determined to pose a risk, determine that the message is deceptive;
• responsive to a determination that the first party is not considered trusted by the second party, determine that the message is not deceptive;
• responsive to the message being found deceptive, automatically perform a security action and a report generation action without having received any user input from a user associated with the second party in response to the message, wherein the security action comprises marking the message up with a warning or quarantining the message, wherein the report generating action comprises including information about the received message in a report accessible to an admin of the system;
• and
• responsive to the message being found not deceptive, deliver the message to the second party;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.

A method for detection of email risk, comprising:

• automatically determining that a first party is considered trusted by a second party, based on at least one of determining that the first party is on a whitelist and that the first party is in an address book associated with the second party;
• receiving a message addressed to the second party from a third party;
• performing a risk determination of the message by determining whether the message comprises a hyperlink and by determining whether a display name of the first party and a display name of the third party are the same or that a domain name of the first party and a domain name of the third party are similar, wherein similarity is determined based on having a string distance below a first threshold or being conceptually similar based on a list of conceptually similar character strings;
• responsive to determining that the message poses a risk automatically performing a security action comprising at least one of marking the message up with a warning, quarantining the message, performing a report generating action comprising including information about the message in a report accessible to an admin, and replacing the hyperlink in the message with a proxy hyperlink.

A method for determining whether an electronic message is deceptive, comprising:

• automatically determining whether a first party is trusted by a second party, based on at least on one of determining that the first party is on a whitelist and that the first party is in an address book associated with the second party;
• receiving a message addressed from a third party distinct from the first party and addressed to the second party;
• performing a risk determination of the received message to determine if the received message poses a risk by determining that a display name of the first party and a display name of third party are the same or that a domain name of the first party and a domain name of the third party are similar, wherein similarity is determined based on having a string distance below a first threshold, or being conceptually similar based on a list of conceptually similar character strings;
• responsive to the first party being trusted by the second party and the received message is determined to pose a risk, determining that the message is deceptive;
• responsive to a determination that the first party is not trusted by the second party, determining that the message is not deceptive;
• responsive to the message being found deceptive, automatically performing a security action and a report generation action without having received any user input from a user associated with the second party in response to the message, wherein the security action comprises marking the message up with a warning or quarantining the message, wherein the report generating action comprises including information about the received message in a report accessible to an admin of the system;
• and
• responsive to the message being found not deceptive, delivering the message to the second party.