Systems and methods to identify a simulated phishing message

1 . A method for detecting a simulated phishing message by an email client plug-in, the method comprising:

receiving, by an email client plug-in configured on one or more processors, coupled to memory, on a client device, a unique key from a server, the unique key assigned to the email client plug-in;

receiving, by the email client plug-in, an indication that an email was reported by a user as a suspicious message, the email communicated by the server as a simulated phishing email having the unique key of that email client plug-in mapped by a cryptographic hashing function into a hash value in a predetermined field in a header of the simulated phishing email;

detecting, by the email client plug-in, presence of the predetermined field in the header of the simulated phishing email, the predetermined field comprising identification of a format to format information to which to apply the cryptographic hashing function by the email client plug-in, the information comprising a list of one of more intended recipients of the simulated phishing email, wherein the format identifies an order and a separator character for which to format the unique key and the list of one or more intended recipients of the simulated phishing email;

combining, by the email client plug-in using the format identified by the predetermined field, the unique key received by the email client plug-in with the list of one or more intended recipients of the simulated phishing email into formatted information using the separator character in the order specified by the format to create a formatted information;

comparing, by the email client plug-in, the hash value in the predetermined field to a local hash value resulting from applying by the email client plug-in the cryptographic hashing function to the formatted information comprising the unique key received by the email client plug-in combined with the list of one or more intended recipients of the simulated phishing using the separator character in the order specified by the format; and

determining, by the email client plug-in responsive to the hash value in the predetermined field being matched to the result, that the suspicious message is a simulated phishing message generated by the server.

2 . The method of claim 1 , further comprising receiving, by the email client plug-in, the unique key upon initialization of the email client plug-in, wherein the unique key is unique to the email client plug-in among a plurality of email client plug-ins.

3 . The method of claim 1 , further comprising receiving, by the email client plug-in, from the server one or more of the following: a list of one or more cryptographic hashing functions for encoding the hash value, identification of the predetermined field, and identification of information to be mapped into the hash value.

4 . The method of claim 1 , wherein the predetermined field in the header of the simulated phishing email comprises identification of a type of the cryptographic hashing function used by the server to create the hash value in the predetermined field.

5 . The method of claim 4 , further comprising identifying, by the email client plug-in, the type of cryptographic hashing function used by the server in the predetermined field and applying the type of cryptographic hashing function to the unique key combined with the list of one or more intended recipients of the simulated phishing in the order specified by the format.

6 . The method of claim 1 , further comprising identifying, by the email client plug-in, the format of the information identified by the predetermined field and applying the cryptographic hashing function to the unique key combined with the list of one or more intended recipients of the simulated phishing in the order specified by the format.

7 . The method of claim 1 , wherein the format comprises a comma separated list of values.

8 . The method of claim 1 , wherein the format comprises an order of values to identify the order of the unique key of the email client plug-in and the information.

9 . A system for detecting a simulated phishing message by an email client plug-in, the system comprising:

an email client plug-in configured on one or more processors, coupled to memory, of a client device and configured to:

receive a unique key from a server, the unique key assigned to the email client plug-in;

receive an indication that an email was reported by a user as a suspicious message, the email communicated by the server as a simulated phishing email having the unique key of that email client plug-in mapped by a cryptographic hashing function into a hash value in a predetermined field in a header of the simulated phishing email;

detect presence of the predetermined field in the header of the simulated phishing email, wherein the predetermined field comprising identification of a format to format information to which to apply the cryptographic hashing function by the email client plug-in, wherein the information comprises a list of one of more intended recipients of the simulated phishing email, wherein the format identifies an order and a separator character for which to format the unique key and the list of one of more intended recipients of the simulated phishing email;

combine, using the format identified by the predetermined field, the unique key received by the email client plug-in with the list of one or more intended recipients of the simulated phishing email into formatted information using the separator character in the order specified by the format to create a formatted information;

compare the hash value in the predetermined field to local hash value resulting from applying by the email client plug-in the cryptographic hashing function to the formatted information comprising the unique key received by the email client plug-in combined with the list of one or more intended recipients of the simulated phishing using the separator character in the order specified by the format; and

determine, responsive to the hash value in the predetermined field being matched to the result, that the suspicious message is a simulated phishing message generated by the server.

10 . The system of claim 9 , wherein the email client plug-in is further configured to receive the unique key upon initialization of the email client plug-in, and wherein the unique key is unique to the email client plug-in among a plurality of email client plug-ins.

11 . The system of claim 9 , wherein the email client plug-in is further configured to receive from the server one or more of the following: a list of one or more cryptographic hashing functions for encoding the hash value, identification of the predetermined field, and identification of information to be mapped into the hash value.

12 . The system of claim 9 , wherein the predetermined field in the header of the simulated phishing email comprises identification of a type of the cryptographic hashing function used by the server to create the hash value in the predetermined field.

13 . The system of claim 12 , wherein the email client plug-in is further configured to identify the type of cryptographic hashing function used by the server in the predetermined field and apply the type of cryptographic hashing function to the unique key combined with the list of one or more intended recipients of the simulated phishing in the order specified by the format.

14 . The system of claim 9 , wherein the email client plug-in is further configured to identify the format of the information identified by the predetermined field and apply the cryptographic hashing function to the unique key combined with the list of one or more intended recipients of the simulated phishing in the order specified by the format.

15 . The system of claim 9 , wherein the format comprises a comma separated list of values.

16 . The system of claim 9 , wherein the format comprises an order of values to identify the order of the unique key of the email client plug-in and the information.