Granted Patent B2

US 12,519,804 · App. 18/374,270 · Granted Jan 6, 2026

Inventor: Hoala Greevy (San Francisco, CA)

Assignee: Paubox, Inc.

H04L63/126H04L63/08H04L63/105

Abstract

Claims (150)

1 . A method comprising:

during a first time period:

intercepting a first email addressed to a first target recipient within an organization, the first email received from a first sender at a first inbound email address and comprising a first inbound display name;

accessing a whitelist comprising a first set of contact information corresponding to a first entity associated with the organization, the first set of contact information comprising:

“a first verified display name associated with the first entity; and

” a first set of verified email addresses associated with the first entity; and

in response to the first set of verified email addresses omitting the first inbound email address:

characterizing a first display name difference between the first inbound display name and the first verified display name associated with the first entity; and

in response to the first display name difference falling below a threshold difference:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication; and

during a second time period:

intercepting a second email addressed to a second target recipient within the organization, the second email received from a second sender at a second inbound email address and comprising a second inbound display name; and

in response to the first set of verified email addresses including the second inbound email address, authorizing transmission of the second email to the second target recipient.

2 . The method of claim 1 , further comprising, during a third time period:

intercepting a third email addressed to a third target recipient within the organization, the third email received from a third sender at a third inbound email address and comprising a third inbound display name; and

in response to the first set of verified email addresses omitting the third inbound email address:

characterizing a second display name difference between the third inbound display name and the first verified display name associated with the first entity; and

in response to the second display name difference exceeding the threshold difference, authorizing transmission of the third email to the third target recipient.

3 . The method of claim 2 . wherein authorizing transmission of the third email to the third target recipient in response to the second display name difference exceeding the threshold difference comprises, in response to the second display name difference exceeding the threshold difference:

characterizing a third display name difference between the third inbound display name and a first verified email address, in the set of verified email addresses, associated with the first entity;

in response to the third display name difference falling below the threshold difference:

withholding transmission of the third email to the third target recipient; and

flagging the third email for authentication; and

in response to the third display name difference exceeding the threshold difference, authorizing transmission of the third email to the third target recipient.

4 . The method of claim 2 :

wherein accessing the whitelist comprising the first set of contact information comprises accessing the whitelist comprising the first set of contact information comprising:

the first verified display name and a second verified display name associated with the first entity; and

the first set of verified email addresses; and

wherein authorizing transmission of the third email to the third target recipient in response to the second display name exceeding the threshold difference comprises in response to the second display name exceeding the threshold difference:

characterizing a third display name difference between the third inbound display name and the second verified display name; and

in response to the third display name difference exceeding the threshold difference, authorizing transmission of the third email to the third target recipient.

5 . The method of claim 2 :

wherein withholding transmission of the first email to the first target recipient and flagging the first email for authentication in response to the first display name difference falling below the threshold difference comprises, in response to the first display name difference falling below the threshold difference:

characterizing a first risk score for risk associated with the first email based on the first entity, the first display name difference, and a first set of email signals extracted from the first email; and

in response to the first risk score exceeding a threshold risk score, withholding transmission of the first email to the first target recipient and flagging the first email for authentication;

wherein authorizing transmission of the third email to the third target recipient in response to the second display name exceeding the threshold difference comprises, in response to the second display name exceeding the threshold difference:

characterizing a second risk score for risk associated with the second email based on the first entity, the second display name difference, and a second set of email signals extracted from the third email; and

in response to the second risk score falling below the threshold risk score, authorizing transmission of the third email to the third target recipient.

6 . The method of claim 1 :

wherein intercepting the first email received from the first sender at the first inbound email address comprises intercepting the first email received from the first sender at the first inbound email address comprising a first domain;

wherein accessing the whitelist comprising the first set of contact information comprises accessing the whitelist comprising:

a set of verified domains associated with the organization;

the first set of contact information corresponding to the first entity and comprising the first verified display name and the first set of verified email addresses comprising a first verified domain in the set of verified domains; and

a second set of contact information corresponding to a second entity associated with the organization and comprising:

a second verified display name associated with the second entity; and

a second set of verified email addresses associated with the second entity and comprising a second verified domain in the set of verified domains;

wherein characterizing the first display name difference in response to the first set of verified email addresses omitting the first inbound email address comprises characterizing the first display name difference in response to the set of verified domains omitting the first domain;

wherein intercepting the second email received from the second sender at the second inbound email address comprises intercepting the second email received from the second sender at the second inbound email address comprising a second domain; and

wherein authorizing transmission of the second email to the second target recipient in response to the first set of verified email addresses including the second inbound email address comprises authorizing transmission of the second email to the second target recipient in response to the set of verified domains including the second domain.

7 . The method of claim 6 , wherein accessing the whitelist comprising the first set of contact information corresponding to the first entity and the second set of contact information corresponding to the second entity comprises accessing the whitelist comprising:

the first set of contact information corresponding to the first entity comprising an internal department within the organization; and

the second set of contact information corresponding to the second entity comprising an external customer associated with the organization.

8 . The method of claim 1 :

wherein intercepting the first email received from the first sender at the first inbound email address and comprising the first inbound display name comprises intercepting the first email received from the first sender at the first inbound email address and comprising the first inbound display name comprising a first set of characters;

wherein accessing the whitelist comprising the first set of contact information comprising the first verified display name and the first set of verified email addresses comprises accessing the whitelist comprising the first set of contact information comprising the first verified display name and the first set of verified email addresses, the first verified display name comprising a set of target characters; and

wherein characterizing the first display name difference between the first inbound display name and the first verified display name comprises characterizing the first difference between the first set of characters and the target set of characters.

9 . The method of claim 1 , wherein characterizing the first difference comprises, in response to the first inbound display name differing from the verified display name:

accessing a word graph defining a population of words distributed within the word graph based on correlations between words in the population of words;

representing the first inbound display name within the word graph based on a set of features extracted from the first inbound display name;

extracting a subset of words, in the population of words, falling within a threshold distance of the first inbound display name within the word graph; and

for a first word, in the subset of words, characterizing the first difference between the word and the verified display name.

10 . The method of claim 1 :

wherein accessing the whitelist comprising the first set of contact information comprises accessing the whitelist comprising the first set of contact information and a second set of contact information corresponding to a second entity associated with the organization, the second set of contact information comprising:

a second verified display name associated with the second entity; and

a second set of verified email addresses associated with the second entity; and

wherein withholding transmission of the first email to the first target recipient and flagging the first email for authentication further comprises:

in response to the second set of verified email addresses omitting the first inbound email address, characterizing a second display name difference between the first inbound display name and the second verified display name associated with the second entity; and

in response to the second display name difference falling below the threshold difference:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication.

11 . The method of claim 1 :

wherein flagging the first email for authentication comprises:

generating a notification comprising a hyperlink to the first email and a prompt to verify authenticity of the first sender; and

transmitting the notification to an email administrator associated with the organization; and

further comprising, in response to receiving verification of the first sender from the email administrator:

authorizing transmission of the first email to the first target recipient; and

appending the first set of contact information associated with the first entity to include the first inbound display name and the first inbound email address.

12 . A method comprising:

during a first time period:

intercepting a first email addressed to a first target recipient within an organization, the first email received from a first sender at a first inbound email address and comprising a first inbound display name;

accessing a whitelist comprising a first set of contact information corresponding to a first entity associated with the organization, the first set of contact information comprising:

a first verified display name associated with the first entity; and

a first set of verified email addresses associated with the first entity;

characterizing a first display name difference between the first inbound display name and the first verified display name associated with the first entity; and

in response to the first display name difference falling below a threshold difference and in response to the first set of verified email addresses omitting the first inbound email address:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication; and

during a second time period:

intercepting a second email addressed to a second target recipient within the organization, the second email received from a second sender at a second inbound email address and comprising a second inbound display name;

characterizing a second display name difference between the second inbound display name and the first verified display name associated with the first entity; and

in response to the second display name difference falling below the threshold difference and in response to the first set of verified email addresses including the second inbound email address, authorizing transmission of the second email to the second target recipient.

13 . The method of claim 12 , further comprising, during a third time period:

intercepting a third email addressed to a third target recipient within the organization, the third email received from a third sender at a third inbound email address and comprising a third inbound display name;

characterizing a third display name difference between the third inbound display name and the first verified display name associated with the first entity; and

in response to the third display name difference exceeding the threshold difference, authorizing transmission of the third email to the third target recipient.

14 . The method of claim 13 , wherein authorizing transmission of the third email to the third target recipient in response to the third display name difference exceeding the threshold difference comprises, in response to the third display name difference exceeding the threshold difference:

characterizing a fourth display name difference between the third inbound display name and a first verified email address, in the set of verified email addresses, associated with the first entity;

in response to the fourth display name difference falling below the threshold difference:

withholding transmission of the third email to the third target recipient; and

flagging the third email for authentication; and

in response to the fourth display name difference exceeding the threshold difference, authorizing transmission of the third email to the third target recipient.

15 . The method of claim 12 :

further comprising, during the first time period:

characterizing a third display name difference between the first inbound display name and a first email address in the set of verified email addresses; and

in response to the third display name difference falling below a second threshold difference and in response to the first set of verified email addresses omitting the first inbound email address:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication;

wherein characterizing the first display name difference between the first inbound display name and the first verified display name comprises in response to the first difference exceeding the second threshold difference, characterizing the first display name difference between the first inbound display name and the first verified display name; and

further comprising, during the second time period:

characterizing a fourth display name difference between the second inbound display name and the first email address in the set of verified email addresses; and

in response to the fourth display name difference falling below the second threshold difference and in response to the first set of verified email addresses omitting the second inbound email address:

withholding transmission of the second email to the second target recipient; and

flagging the second email for authentication.

16 . The method of claim 12 , further comprising, in response to the second display name difference falling below the threshold difference and in response to the first set of verified email addresses including the second inbound email address:

generating a notification comprising a prompt to verify the second display name for emails sent from the second email address;

transmitting the prompt to the second sender at the second email address; and

in response to receiving verification of the second display name from the second sender, appending the whitelist to include the second display name associated with the first entity.

17 . The method of claim 12 :

wherein accessing the whitelist comprising the first set of contact information comprising the first verified display name and the first set of verified email addresses comprises accessing the whitelist comprising the first set of contact information comprising the first verified display name and the first set of verified email addresses comprising a first verified domain associated with the first entity; and

wherein characterizing the first display name difference between the first inbound display name and the first verified display name comprises:

extracting a first domain of the first inbound email address;

in response to the first domain differing from the first verified domain, characterizing the first display name difference between the first inbound display name and the first verified display name; and

in response to the first domain matching the first verified domain, authorizing transmission of the first email to the first target recipient.

18 . A method comprising:

during a first time period:

intercepting a first email addressed to a first target recipient within an organization, the first email comprising a first inbound display name and received from a first sender at a first inbound email address comprising a first domain;

accessing a whitelist comprising:

a set of verified domains associated with inbound emails received by recipients within the organization; and

a first set of contact information corresponding to a first entity associated with the organization, the first set of contact information comprising:

a first verified display name associated with the first entity; and

a first set of verified email addresses associated with the first entity; and

in response to the set of verified domains omitting the first domain and in response to the first set of verified email addresses omitting the first inbound email address:

characterizing a first display name difference between the first inbound display name and the first verified display name; and

in response to the first display name difference falling below a threshold difference:

withholding transmission of the first email to the first target recipient; and

flagging the first email for authentication; and

during a second time period:

intercepting a second email addressed to a second target recipient within the organization, the second email:

received from a second sender at a second inbound email address comprising a second domain; and

comprising a second inbound display name; and

in response to the set of verified domains including the second domain, authorizing transmission of the second email to the second target recipient.

19 . The method of claim 18 , further comprising, during a third time period:

intercepting a third email addressed to a third target recipient within the organization, the third email comprising a third inbound display name and received from a third sender at a third inbound email address;

in response to the set of verified domains omitting the third domain and in response to the first set of verified email addresses including the third inbound email address, authorizing transmission of the third email to the third target recipient.

20 . The method of claim 18 , further comprising, during a third time period:

intercepting a third email addressed to a third target recipient within the organization, the third email comprising a third inbound display name and received from a third sender at a third inbound email address; and

in response to the set of verified domains omitting the third domain and in response to the first set of verified email addresses omitting the third inbound email address:

characterizing a second display name difference between the third inbound display name and the first verified display name; and

in response to the second display name difference exceeding the threshold difference, authorizing transmission of the third email to the third target recipient.

Assignments (3)

Continuity (6)

References Cited (17)