Email channel: phishing and original message

ES EN

Copy page

Phishing and impersonation warnings

MuseRelay checks every incoming email and warns you if it looks like a scam: emails pretending to be a bank, a shop, the tax office or your own company to make you open a link, download a file or pay something.

To decide, it looks at things such as:

• Whether the sender is who they claim to be: for example, an email signed “Mercadona” that comes from another domain, or that fails the email security checks (SPF, DKIM and DMARC).
• Domains that imitate others: paypa1.com instead of paypal.com, rnercadona.es (“rn” instead of “m”) or letters from other alphabets that look normal. It also protects your company's domain and those of your customers and suppliers, which MuseRelay learns from your conversations.
• Dangerous attachments: .html files, programs or files with a double extension such as invoice.pdf.exe.
• Trick links: the text shows one website and the link leads to another.
• Urgency and pressure: “overdue invoice”, “account suspended”, “claim your prize”…

When an email is suspicious you will see an amber warning; if it has several signs of fraud, a red possible-phishing warning with the reasons. A label also appears in the conversation list and, if it has dangerous attachments, you will be asked to confirm before opening them.

For an email flagged as phishing, the AI does not reply and the bell does not ring. If you have doubts about an email, use ✨ → Security check for an explained second opinion.

Suspicious emails (amber) do ring the bell, because they may be legitimate. Neither phishing nor suspicious emails go on the Leads board.

If a warning is wrong, click “Not phishing”: emails from that address will no longer be flagged in that mailbox.

It is an aid, not a guarantee: if in doubt, do not open links or attachments and confirm with the sender through another channel.

View the original message (headers)

Below each received email, "Show original" opens the technical details of the message, like in Gmail:

• Message ID: the unique identifier set by the sending server. It is used to group replies in the same conversation, avoid duplicates or ask the sender's provider to find a specific email.
• Creation and reception date, sender, recipients and subject.
• SPF, DKIM and DMARC: in green (PASS) the email came from servers authorised by the sender's domain; in red, be careful.
• The full headers, a button to copy them and another to download the original email (.eml).