System and method for verifying the identity of email senders to improve email security within an organization

1. A method comprising:

intercepting a first email addressed to a first target recipient within an organization, the first email received from a first sender at a first inbound email address and comprising a first inbound display name;

accessing a whitelist comprising a first set of contact information corresponding to a first employee within the organization, the first set of contact information comprising:

a first verified display name associated with the first employee; and

a first set of verified email addresses associated with the first employee;

characterizing a first display name difference between the first inbound display name and the first verified display name associated with the first employee; and

in response to the first display name difference falling below a threshold difference:

comparing the first inbound email address to the first set of verified email addresses associated with the first employee;

in response to identifying the first inbound email address in the first set of verified email addresses, authorizing transmission of the first email to the first target recipient; and

in response to the first set of verified email addresses omitting the first inbound email address:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication.

2. The method of claim 1 , further comprising, in response to the first display name difference exceeding the threshold difference, authorizing transmission of the first email to the target recipient.

3. The method of claim 1 , further comprising, in response to identifying the first inbound email address in the first set of verified email addresses:

authenticating the first sender; and

generating a notification for inclusion in the first email indicating authentication of the first sender.

4. The method of claim 1 :

further comprising, in response to flagging the first email for authentication, transmitting a notification to an email administrator requesting authentication of the first email; and

wherein the notification comprises a hyperlink to the first email.

5. The method of claim 4 , further comprising:

in response to receiving authentication of the first email from the email administrator authorizing transmission of the first email to the first target recipient; and

in response to receiving rejection of the first email from the email administrator, discarding the first email.

6. The method of claim 1 , further comprising, in response to the first set of verified email addresses omitting the first inbound email address, adding the first inbound email address to a blacklist comprising a set of fraudulent email addresses corresponding to fraudulent email attempts.

7. The method of claim 6 , further comprising:

intercepting a second email addressed to a second target recipient within an organization, the second email received from a second sender at the first inbound email address and including a second inbound display name;

accessing the blacklist;

comparing the first email address to the set of fraudulent email addresses; and

in response to identifying the first inbound email address in the set of fraudulent email addresses, withholding transmission of the second email to the second target recipient.

8. The method of claim 1 :

wherein comparing the first inbound email address to the first set of verified email addresses comprises:

comparing a first domain of the first inbound email address to a set of verified domains of the first set of verified email addresses; and

comparing a first handle of the first inbound email address to a set of verified handles corresponding to the first set of verified domains of the first set of verified email addresses;

wherein authorizing transmission of the first email in response to identifying the first inbound email address in the first set of verified email addresses comprises authorizing transmission of the first email in response to identifying a combination of the first domain and the first handle in the first set of verified email addresses; and

wherein withholding transmission of the first email in response to the first set of verified email addresses omitting the first inbound email address comprises withholding transmission of the first in response to the first set of verified email addresses omitting the combination of the first domain and the first handle.

9. The method of claim 1 :

wherein characterizing the first display name difference between the first inbound display name and the first verified display name comprises:

comparing a first set of characters of the first inbound display name to:

a first set of authentic characters comprising a forename of the first employee; and

a second set of authentic characters comprising a surname of the first employee;

comparing a second set of characters of the first inbound display name to:

the first set of authentic characters; and

the second set of authentic characters.

10. The method of claim 1 , wherein characterizing the first display name difference between the first inbound display name and the first verified display name comprises:

comparing a first set of characters of the first inbound display name to a first set of authentic characters of the first verified display name;

identifying a first set of differences between the first set of characters and the first set of authentic characters; and

characterizing the first display name difference based on the first set of differences.

11. The method of claim 10 :

wherein identifying a set of differences between the first set of characters and the first set of authentic characters comprises identifying a first difference between the first set of characters and the first set of authentic characters;

wherein identifying the first difference comprises identifying a first character, in the first set of characters, excluded from the first set of authentic characters; and

wherein characterizing the first display name difference based on the first set of differences comprises characterizing the first display name difference based on a quantity of differences in the first set of differences.

12. The method of claim 1 , further comprising:

extracting a first forename from the first inbound display name;

accessing a name graph comprising a set of forenames, each forename connected to a subset of forenames, in the set of forenames, based on relationships between forenames;

identifying the first forename in the set of forenames of the name graph;

generating a list of related forenames comprising the first forename and a first subset of forenames connected to the first forename in the name graph;

comparing an authentic forename of the first employee to the list of related forenames; and

in response to identifying the authentic forename in the list of related forenames:

extracting a first surname from the first inbound display name; and

comparing an authentic surname of the first employee to the first surname.

13. The method of claim 1 :

wherein, in response to identifying the first inbound email address in the first set of verified email addresses, authorizing transmission of the first email to the first target recipient further comprises:

transmitting a prompt requesting confirmation of the inbound display name to the first employee;

in response to receiving rejection of the inbound display name from the first employee, withholding transmission of the first email to the first target recipient; and

in response to receiving confirmation of the inbound display name from the first employee:

adding the inbound display name to the first set of contact information, corresponding to the first employee, within the whitelist; and

authorizing transmission of the first email to the first target recipient.

14. The method of claim 1 , further comprising:

intercepting a second email addressed to a second target recipient within the organization, the second email received from a second sender at a second inbound email address and including a second inbound display name;

accessing the whitelist comprising a second set of contact information corresponding to a second employee within the organization, the second set of contact information comprising:

a second verified display name associated with the second employee; and

a second set of verified email addresses associated with the second employee;

characterizing a second display name difference between the second inbound display name and the second verified display name associated with the second employee; and

in response to the second display name difference exceeding a threshold difference, authorizing transmission of the second email to the second target recipient.

15. The method of claim 1 :

further comprising, in response to flagging the first email for authentication, transmitting the first email to a quarantine portal for authentication; and

wherein transmitting the first email to the quarantine portal comprises inserting the first email within a list of quarantined emails within the quarantine portal, the list of quarantined emails sorted by display name difference in descending order.

16. The method of claim 1 , further comprising:

in response to flagging the first email for authentication, transmitting the first email to a quarantine portal for authentication by an email administrator;

at a first time, in response to receiving rejection of the first email from the email administrator, adding the first inbound display name to a blacklist comprising a set of fraudulent email addresses;

at a second time succeeding the first time, intercepting a second email addressed to a second target recipient within the organization, the second email received from a second sender at the first inbound email address;

accessing the blacklist comprising the first inbound display name; and

in response to identifying the first inbound display name in the set of fraudulent email addresses:

withholding transmission of the second email to the second target recipient; and

discarding the second email.

17. The method of claim 1 :

wherein accessing the whitelist comprises accessing the whitelist comprising:

the first set of contact information corresponding to the first employee within the organization; and

a second set of contact information corresponding to a second employee within the organization, the second set of contact information comprising:

a second verified display name associated with the second employee; and

a second set of verified email addresses associated with the second employee; and

further comprising, in response to the first display name difference exceeding the threshold difference, characterizing a second display name difference between the first inbound display name and a second verified display name associated with the second employee.

18. The method of claim 17 :

wherein accessing the whitelist comprises accessing the whitelist comprising:

the first set of contact information corresponding to the first employee of a first rank within the organization; and

the second set of contact information corresponding to the second employee of a second rank below the first rank within the organization;

wherein comparing the first inbound email address to the first set of verified email addresses in response to the first display name difference falling below the threshold difference comprises comparing the first inbound email address to the first set of verified email addresses in response to the first display name difference falling below a first threshold difference corresponding to employees of the first rank;

further comprising, in response to the second display name difference falling below a second threshold difference less than the threshold difference, the second threshold difference corresponding to employees of the second rank; and

further comprising in response to the second display name difference exceeding the second threshold difference, authorizing transmission of the first email.

19. A method comprising:

intercepting a first email addressed to a first target recipient within an organization, the first email received from a first sender at a first inbound email address and including a first inbound display name;

accessing a first set of contact information corresponding to a first employee within the organization, the first set of contact information comprising:

a first set of verified email addresses associated with the first employee; and

a first verified display name associated with the first employee;

comparing the first inbound email address to the first set of verified email addresses associated with the first employee; and

in response to the first set of verified email addresses excluding the first inbound email address:

characterizing a first display name difference between the first inbound display name and the first verified display name associated with the first employee;

in response to the first display name difference exceeding the threshold difference, authorizing transmission of the first email to the first target recipient; and

in response to the first display name difference falling below a threshold difference:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication.

20. The method of claim 19 , further comprising, in response to identifying the first inbound email address in the first set of verified email addresses, authorizing transmission of the first email to the first target recipient.