Brochure

SIFT Email Fraud Intelligence

The costly kind carries no virus and no bad link.
Your filter passes it straight to the inbox.

19%
of all cybercrime reports are phishing
More than twice the reports of the next crime type on the list. It starts in someone’s inbox.
FBI IC3 Annual Report 2025
15%
of all reported losses are business email compromise
From under 3% of complaints. No malware, no breach. Someone was asked to pay, and paid.
FBI IC3 Annual Report 2025
60%
of breaches start with a person
Error, manipulation or misuse. Not malware, not a firewall gap. A person acting on a message.
Verizon DBIR 2025
30%
come through your suppliers
Doubled in a year. Their compromised mailbox, your payment.
Verizon DBIR 2025
84.3%
of South African business domains can be spoofed
Our own census of 58,769 domains. That is your suppliers and your clients: anyone can send mail in their name, and it arrives looking exactly right.
CyberFrame SA Email Security Census 2026
01Why you need it

The email that costs money.

No virus. No bad link. Just a request to pay.
Standard filters don’t read it. SIFT does.

A supplier’s email gets hacked.

The email is real. The request is not.

The boss wants a payment today.

Is it really the boss?

Payroll gets new bank details.

Is it really the employee?

SIFT reads what each email is asking for and catches the fraud before anyone acts on it, with the reason written out.

SIFT Email Fraud Intelligence

SIFT sits in front of your existing mail and reads what each message is asking for. Payment fraud, banking-detail changes and impersonation are held, each with a written reason. One DNS change. Nothing to install.

  • Microsoft 365
  • Google Workspace
  • cPanel hosting
  • SA hosted email
  • Any standard mailbox
02What you get, side by side

What SIFT catches

Out of the box, Microsoft 365 fully covers none of the 16 threats below. Eight need the paid Defender add-on. Two it cannot catch at all. Hover or tap any row for detail.

Threat SIFT Microsoft 365default filtering Google Workspacedefault filtering Typical spam filter
Payment fraud: where the money goes
A compromised supplier replying inside a real thread passes every authentication check. SIFT judges the request, not the sender.Included. This is what SIFT is for.A compromised supplier replying in a real thread passes every Microsoft check, because the sender is genuine.Not part of the default product.Not part of the default product.
Any request to pay, change bank details or approve a payment is held for review before anyone can act on it.Included. This is what SIFT is for.Defender can flag an impersonated sender. A genuine supplier account asking for new bank details passes it.Not part of the default product.Not part of the default product.
Payment-scam wording is caught on its own. No link or attachment needed: the AI reads what the message is asking for.Included. This is what SIFT is for.Defender for Office 365 (Business Premium or E5) flags impersonation of the people and domains you list. It does not read what the message is asking for.Not part of the default product.Not part of the default product.
Anyone posing as the boss, a bank or an attorney, judged by what the message asks for rather than by who it claims to be.Included. This is what SIFT is for.Defender protects the names you add to its list. Anyone not on the list is not checked.Some coverage, but it does not hand you a held message with the reasoning on it.Not part of the default product.
Mail from a sender you have never dealt with, or from a fresh free-mail address, is held and investigated before delivery.Included. This is what SIFT is for.A first-contact warning banner, switched off by default. The message is still delivered.Not part of the default product.Not part of the default product.
A sender one letter off from a real supplier, or a familiar name over a strange address, is treated as the attack it is.Included. This is what SIFT is for.Defender for Office 365, bought per user or bundled in Business Premium and E5. Not in Business Basic or Standard.Some coverage, but it does not hand you a held message with the reasoning on it.Not part of the default product.
Links, attachments and senders
Every link is checked against live threat-intelligence DNS, including shortened, redirecting and hidden URLs.Included. This is what SIFT is for.Defender for Office 365, bought per user or bundled in Business Premium and E5. Not in Business Basic or Standard.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.
A link to a domain registered days ago starts with a mark against it. Attack infrastructure is nearly always new.Included. This is what SIFT is for.Defender for Office 365, bought per user or bundled in Business Premium and E5. Not in Business Basic or Standard.Not part of the default product.Not part of the default product.
SharePoint, OneDrive and Drive links that are not yours are not trusted just because the brand is.Included. This is what SIFT is for.Defender for Office 365, bought per user or bundled in Business Premium and E5. Not in Business Basic or Standard.Some coverage, but it does not hand you a held message with the reasoning on it.Not part of the default product.
A QR code in an image carries the payload past text-based link checks. SIFT reads the code and checks where it points.Included. This is what SIFT is for.Defender for Office 365, bought per user or bundled in Business Premium and E5. Not in Business Basic or Standard.Some coverage, but it does not hand you a held message with the reasoning on it.Not part of the default product.
Office files carrying macros, or remote templates that fetch their payload after opening, are held.Included. This is what SIFT is for.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.
Learned per sender over time from what was delivered and what was held, and shared across every domain SIFT protects. Not just IP reputation.Included. This is what SIFT is for.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.
Senders guessing at addresses that do not exist lose reputation fast.Included. This is what SIFT is for.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.
Living with it
Every hold shows the signals that moved the score and the AI’s own reading of the message.Included. This is what SIFT is for.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.Not part of the default product.
If a held message is genuine, it goes through immediately and SIFT learns from it.Included. This is what SIFT is for.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.Some coverage, but it does not hand you a held message with the reasoning on it.
Microsoft 365, Google Workspace, cPanel, South African hosted mail, any standard mailbox. One DNS change.Included. This is what SIFT is for.Not part of the default product.Not part of the default product.Included in the default product, at no extra cost.
The baseline every filter covers
The baseline every mail filter covers. SIFT does all of it too, so you lose nothing by adding it.Included.Included in the default product, at no extra cost.Included in the default product, at no extra cost.Spam and malware yes; authentication and phishing checks vary by product.
01

Every message scored

Sender, wording, links, and the sender’s usual pattern.

02

AI reads the intent

An AI reviewer that knows your business works out what it wants.

03

Fraud held back

Fake invoices, new banking details, anyone posing as a supplier.

04

Plain-English reasons

Why it was held, in plain words. Release in one click.

Scan an email Get Started
03Does it work?
Case studyMicrosoft 365

Fraud that looked clean. SIFT caught it.

1 in 10threats that SIFT caught looked clean to Microsoft
99.9%+accuracy

SIFT clients on Microsoft 365, 90 days study. We compared Microsoft’s verdict on every email with SIFT’s: on 1 in 10 of the serious threats SIFT caught, Microsoft showed no warning signs. 99.9%+ accuracy.

04Free trial

Test it on your own mail.

SIFT watches your real mail for 30 days and holds nothing until you say so.

  1. 1

    Link

    Connect your mailbox. Nothing to install.

  2. 2

    Watch

    Read-only access. Nothing is held.

  3. 3

    Decide

    See what it would have held.

  4. 4

    Protect

    Switch on. SIFT holds the threats.

Built with security in mind

Your data

  • TLS encryption on every connection
  • Backups public-key encrypted
  • Personal data redacted before any AI review
  • Zero data retention at the AI provider
  • Retention set per client, deleted automatically

Your control

  • Read-only Microsoft 365 mailbox access
  • Two-factor sign-in, required by role
  • Roles: admin, analyst, read-only
  • Every release and rule change logged, by name
  • Monitored around the clock, with alerts

Try it free for 30 days.

Then $1.50 (R25) per mailbox a month.

I’m interested Scan an email