Fromensics
Help
Every answer Fromensics gives, explained
Fromensics checks one email at a time, on your device, and answers with what to do. These pages show each screen you can see, when it appears, and what to do next.
The five answers
- Don’t pay
Something is wrong: a lookalike address, an email changed after signing, or strong scam signs. The title says what not to do: pay, sign in, or reply.
- Check first
Something needs a second look, like a company name that doesn’t match the address. Check the domain once, or always.
- Nothing looks off
The checks that ran found nothing wrong. Fromensics never calls an email “safe”.
- Verified
Signed with a key you confirmed, and nothing changed after it was signed.
- New key
A sender signed with a key you haven’t confirmed yet. Compare four words on a phone call.
How the answer is chosen
- You click Check sender on an open email, or press Alt+Shift+F.
- Fromensics reads that one email in your browser and runs its checks in code: the sender, lookalike addresses, authentication, links, payment details, the Fromensics threat list, and signatures.
- A signature or your trusted senders decide first. A valid signature from a key you confirmed means Verified. An email changed after signing, or a lookalike of someone you trust, means Don’t pay.
- Otherwise the checks decide: Don’t pay, Check first, or Nothing looks off. The same email always gets the same answer.
- If you turn on Chrome’s on-device AI, it explains the answer in plain words. It can’t change it.
Before you pay
Check an invoice emailDon’t pay, Check first, or Nothing looks off, before money moves.Bank details changed?See the account an email wants you to pay, and whether it’s new.Spot a lookalike addressAddresses one letter or word away from someone you trust.Is this email a scam?One click for one answer, with every reason listed.Check a domain’s ageLook up one domain, only when you say so.SPF, DKIM and DMARCRead an email’s authentication results from its headers.
Signed email
Verified sendersKnow an email is really from them, not a hijacked mailbox.Sign your emailsA quiet line that proves an email came from you.Check a signatureCheck a “Signed with Fromensics” email, no install needed.Changed after signingWhat “Don’t pay. This email was changed.” means.Confirm a new keyFour words, one phone call, and their emails show as verified.