Detection of forged e-mail messages at e-mail gateway
An e-mail message is sent from a public e-mail address via the e-mail account of a user and delivered to an e-mail gateway. The message is destined for the e-mail account of a recipient. The gateway determines that the public e-mail address is on a list of users desiring two-factor authentication. The gateway determines that the message contains an anomaly indicating fraud or possible forgery. The gateway sends a two-factor authentication message to a hidden e-mail account of the user. The user reviews the message and responds with a confirmation message either confirming that the message is legitimate or indicating that it is a forgery. If the message is legitimate the gateway allows the message to be delivered to the recipient; if not, the message remains in quarantine and is not delivered. The gateway exists at the user's corporation, the recipient's corporation or is hosted at a third-party cloud service.
1. A method of detecting a forged e-mail message, said method comprising:
receiving, at an e-mail gateway within an enterprise, an e-mail message from a sender e-mail account having a sender e-mail address, said sender e-mail account belonging to an individual;
detecting that said e-mail message has an anomaly indicative of fraud;
retrieving a private e-mail address of said individual from a database using said sender e-mail address, wherein said private e-mail address is a hidden e-mail address not known to the public;
sending said e-mail message to said private e-mail address;
receiving a response from said private e-mail address indicating that said e-mail message is a forgery; and
not delivering said e-mail message to a recipient e-mail address of a recipient within said enterprise.
2. A method as recited in claim 1 further comprising:
sending said sender e-mail address to said database and determining that said sender e-mail address is present within said database.
3. A method as recited in claim 1 further comprising:
detecting said anomaly using text matching of words in said e-mail message.
4. A method as recited in claim 1 further comprising:
detecting said anomaly by determining that a location of a computer used to send said e-mail message is abnormal.
5. A method as recited in claim 1 further comprising:
detecting said anomaly by determining that a time when said e-mail message is sent is abnormal.
6. A method as recited in claim 1 further comprising:
detecting said anomaly by determining a number of attachments to said e-mail message.
7. A method as recited in claim 1 wherein said private e-mail address is only used to receive e-mail messages from said e-mail gateway and to send e-mail messages to said e-mail gateway.
8. A method of detecting a forged e-mail message, said method comprising:
receiving, at an e-mail gateway within an enterprise before being sent over the Internet, an e-mail message from a sender e-mail account having a sender e-mail address within said enterprise, said sender e-mail account belonging to an individual;
detecting that said e-mail message has an anomaly indicative of fraud;
retrieving a private e-mail address of said individual from a database using said sender e-mail address, wherein said private e-mail address is a hidden e-mail address not known to the public;
sending said e-mail message to said private e-mail address;
receiving a response from said private e-mail address indicating that said e-mail message is a forgery; and
not delivering said e-mail message to a recipient e-mail address of a recipient.
9. A method as recited in claim 8 further comprising:
sending said sender e-mail address to said database and determining that said sender e-mail address is present within said database.
10. A method as recited in claim 8 further comprising:
detecting said anomaly by analyzing a writing style of said e-mail message.
11. A method as recited in claim 8 further comprising:
detecting said anomaly by determining that a location of a computer used to send said e-mail message is abnormal.
12. A method as recited in claim 8 further comprising:
detecting said anomaly by determining that a time when said e-mail message is sent is abnormal.
13. A method as recited in claim 8 further comprising:
sending to said private e-mail address, along with said e-mail message, a first selection to release said e-mail message from quarantine and deliver said e-mail message and a second selection to not deliver said e-mail message.
14. A method as recited in claim 8 wherein the private e-mail account of said private e-mail address has no received messages other than e-mail messages received from said e-mail gateway and has no sent e-mail messages other than e-mail messages sent to said e-mail gateway.
15. A method of detecting a forged e-mail message, said method comprising:
receiving, at an e-mail gateway within a cloud service, an e-mail message from a sender e-mail account having a sender e-mail address, said sender e-mail account belonging to an individual;
detecting that said e-mail message has an anomaly indicative of fraud;
retrieving a private e-mail address of said individual from a database using said sender e-mail address, wherein said private e-mail address is a hidden e-mail address not known to the public;
sending said e-mail message to said private e-mail address;
receiving a response from said private e-mail address indicating that said e-mail message is a forgery; and
not delivering said e-mail message to a recipient e-mail address of said e-mail message.
16. A method as recited in claim 15 further comprising:
sending said sender e-mail address to said database and determining that said sender e-mail address is present within said database.
17. A method as recited in claim 15 wherein said e-mail message has not been sent by said individual.
18. A method as recited in claim 15 further comprising:
placing said e-mail message in quarantine after said detecting.
19. A method as recited in claim 15 wherein said sending to said private e-mail address includes a first selection to release said e-mail message from quarantine and deliver said e-mail message to said recipient e-mail address, said method further comprising:
receiving a response from said private e-mail address indicating that said e-mail message is legitimate; and
delivering said e-mail message to said recipient e-mail address of said e-mail message.
20. A method as recited in claim 15 wherein said private e-mail address is only used to receive e-mail messages from said e-mail gateway and to send e-mail messages to said e-mail gateway.