Five things we learned building scam detection into an Outlook add-in

OutlookDog — Tue, 15 Sep 2026 16:53:38 +0000

Disclosure: we build OutlookDog, an AI add-in for Outlook — this post is the engineering lessons, not a pitch.

After a year of building email-safety features on the Office add-in platform, here are five lessons that might help anyone working in this space.

1. Plain English beats jargon

Users don't act on "SPF fail" — they act on "this sender looks like your vendor but isn't." We demoted every protocol term to a footnote and warnings started working.

2. Advisory-only is a feature, not a limitation

An add-in that can't send, delete, or move mail can't be tricked into doing any of those things — by a user mistake, a prompt injection, or a malicious email pretending to be a rule. It's also the difference between "please approve this add-in" going well or badly with an IT team.

3. Authentication failures must survive safelisting

A message that fails identity checks gets warned about even if the user marked that sender safe — the spoof of a trusted sender is exactly the mail the safelist would otherwise wave through.

4. A visible wrong warning beats a silent missed one

We tuned toward warn-and-explain: every flag shows its specific red flags so the user can judge in seconds. False-positive complaints dropped when the reason became visible, not when the warnings got rarer.

5. The wire-fraud email is the whole ballgame for small firms

For a title company, a closing practice, a property manager — one caught "updated wiring instructions" email pays for a decade of any tool. That's the email to design for, not the lottery-scam strawman.