System and method for verifying the identity of email senders to improve email security within an organization

1 . A method comprising:

intercepting an email addressed to a recipient, the email received from an inbound email address and comprising an inbound display name;

characterizing a display name difference between the inbound display name and a verified display name defined for a first entity; and

in response to the display name difference falling below a threshold difference:

in response to a set of verified email addresses, associated with the first entity, omitting the inbound email address:

withholding transmission of the email to the recipient.

2 . The method of claim 1 , further comprising:

wherein intercepting the email addressed to the recipient comprises intercepting the email addressed to the recipient within an organization; and

wherein characterizing the display name difference between the inbound display name and the verified display name defined for the first entity comprises characterizing the display name difference between the inbound display name and the verified display name defined for the first entity associated with the organization.

3 . The method of claim 1 , further comprising, in response to the display name difference falling below the threshold difference and in response to identifying the inbound email address in the set of verified email addresses, authorizing transmission of the email to the recipient.

4 . The method of claim 3 :

wherein intercepting the email received from the inbound email address comprises intercepting the email received from the inbound email address at a domain;

further comprising accessing a set of verified domains; and

wherein authorizing transmission of the email to the recipient in response to identifying the inbound email address in the set of verified email addresses comprises:

in response to identifying the domain in the set of verified domains and in response to identifying the inbound email address in the set of verified email addresses, authorizing transmission of the email.

5 . The method of claim 1 :

wherein intercepting the email received from the inbound email address comprises intercepting the email received from the inbound email address at a domain;

further comprising accessing a set of verified domains; and

wherein withholding transmission of the email to the recipient in response to the set of verified email addresses omitting the inbound email address comprises:

in response to the set of verified email addresses omitting the inbound email address and in response to the set of verified domains omitting the domain, withholding transmission of the email.

6 . The method of claim 1 , further comprising, in response to the set of verified email addresses omitting the inbound email address:

generating a notification comprising:

a hyperlink to the email; and

a request for authentication;

transmitting the notification to an email administrator; and

in response to receiving authorization of the email from the email administrator, transmitting the email to the recipient.

7 . The method of claim 6 , further comprising, in response to the email administrator approving the authentication:

generating a prompt to approve the inbound email address; and

in response to receiving approval of the inbound email address from the email administrator:

populating a whitelist with the inbound display name and the inbound email address.

8 . The method of claim 7 , further comprising:

receiving a second email addressed to a second recipient within the organization, the second email received from the inbound email address; and

in response to identifying the inbound email address in the whitelist, transmitting the email to the second recipient.

9 . The method of claim 1 , further comprising, in response to identifying the inbound email address in the set of verified email addresses associated with the first entity:

appending the email with a marker indicating the email as authenticated; and

authorizing transmission of the email to the recipient.

10 . The method of claim 1 , further comprising:

wherein intercepting the email addressed to the recipient comprises intercepting the email addressed to the recipient within an organization;

further comprising:

at a first time, in response to the set of verified email addresses omitting the inbound email address, populating a set of fraudulent email addresses, associated with the organization, with the inbound email address; and

at a second time succeeding the first time:

intercepting a second email addressed to a second recipient in the organization, the second email received from the inbound email address; and

in response to identifying the inbound email address in the set of fraudulent email addresses, withholding transmission of the second email to the second recipient.

11 . A method comprising:

in response to intercepting a first email addressed to a first recipient, the first email received from a first email address and comprising a first display name:

accessing a set of verified display names and a set of verified email addresses;

characterizing a first display name difference between the first display name and a first verified display name in the set of verified display names; and

in response to the first display name difference falling below a threshold difference and in response to the set of verified email addresses omitting the first email address, withholding transmission of the first email to the first recipient; and

in response to intercepting a second email addressed to a second recipient, the second email received from a second email address and comprising a second display name:

characterizing a second display name difference between the second display name and a second verified display name in the set of verified display names; and

in response to the second display name difference exceeding the threshold difference, authorizing transmission of the second email to the second recipient.

12 . The method of claim 11 :

in response to intercepting a third email addressed to a third recipient, the third email received from a third email address and comprising a third display name, characterizing a third display name difference between the third display name and a third verified display name in the set of verified display names; and

in response to the third display name difference falling below the threshold difference and in response to identifying the third email address in the set of verified email addresses, authorizing transmission of the third email to the third recipient.

13 . The method of claim 11 , further comprising:

in response to the set of verified email addresses omitting the first email address, populating a set of fraudulent email addresses with the first email address;

intercepting a third email addressed to a third recipient, the third email received from the first email address; and

withholding transmission of the third email to the third recipient in response to identifying the first email address in the set of fraudulent email addresses.

14 . The method of claim 11 , further comprising, in response to the set of verified email addresses omitting the first email address:

generating a notification comprising:

a hyperlink to the first email; and

a request for authentication;

transmitting the notification to an email administrator; and

in response to receiving authorization of the first email from the email administrator, transmitting the first email to the first recipient.

15 . The method of claim 11 :

wherein intercepting the email received from the first inbound email address comprises intercepting the email received from the first inbound email address at a domain;

further comprising accessing a set of verified domains; and

wherein withholding transmission of the email to the recipient comprises:

in response to the set of verified domains omitting the domain, withholding transmission of the email.

16 . The method of claim 11 , further comprising:

wherein intercepting the email addressed to the recipient comprises intercepting the email addressed to the recipient within an organization;

further comprising:

at a first time, in response to the first set of verified email addresses omitting the first inbound email address, populating a set of fraudulent email addresses with the first inbound email address; and

at a second time succeeding the first time:

intercepting a third email addressed to a third recipient within the organization, the third email received from the first inbound email address; and

in response to identifying the first inbound email address in the set of fraudulent email addresses, withholding transmission of the third email to the third recipient.

17 . A method comprising:

intercepting an email addressed to a recipient, the email received from an inbound email address and comprising an inbound display name;

accessing a set of verified email addresses and a verified display name associated with an entity; and

in response to the set of verified email addresses excluding the inbound email address:

characterizing a display name difference between the inbound display name and the verified display name associated with the entity; and

in response to the display name difference exceeding the threshold difference, authorizing transmission of the email to the recipient.

18 . The method of claim 17 , further comprising in response to the display name difference falling below the threshold difference, withholding transmission of the email to the recipient.

19 . The method of claim 17 , further comprising appending the email with a marker indicating the email as authenticated.

20 . The method of claim 17 , wherein characterizing the display name difference between the inbound display name and the verified display name associated with the entity comprises:

accessing a set of names, each name connected to a subset of names in the set of names;

identifying the inbound display name in the set of names;

generating a list of related names comprising the inbound display name and a subset of names, in the set of names, associated with the inbound display name; and

in response to identifying a second verified display name for the entity in the list of related names, characterizing an email address difference between the inbound email address and the set of verified email addresses.