Detect phishing emails and suspicious sign-ins

IT detects phishing emails and suspicious sign-ins

Needs setupAI Act: no extra obligationsFinding anomalies & fraudAll industries

Fits: IT & software development

Fake emails and sign-ins with stolen passwords stand out before an account is taken over. IT responds to a few good alerts instead of a flood of warnings.

Is this for you?

  • You use email and applications in the cloud or on your own network with central sign-in.
  • Phishing emails regularly get through, and employees report them without anyone analysing the reports systematically.
  • Sign-in logs are stored but hardly ever looked at.
First step today

Based on the format of your sign-in log, build a small table with made-up accounts, about 20 rows with time, account number, country, known or new device, result and second factor, and insert two typical attacks. Use the template below to check whether the rules find the attacks and leave harmless cases alone.

How to go about it

  1. Define which emails and sign-ins are suspicious
  2. Bring together mail filters, sign-in logs and device lists
  3. Set up detection rules and the model
  4. Have IT check the warnings
  5. Secure the account and inform employees
  6. Adapt the rules to new attack methods

Templates to copy

Try it now
in the training
Analyse
in the training
Plan the rollout
in the training
Included in the training

The complete guide

  • 6 steps explaining exactly what to do
  • 3 proven templates to copy into your own AI
  • Safe use: data, checking, deciding, informing
  • Pitfalls, effort and how to recognise success

With the training you get all 430 guides for as long as your access runs.

See the trainingOne-off per person, no subscription

Same approach, other use cases

12 more use cases follow the pattern “Finding anomalies & fraud”.

Check claim notifications for signs of fraudCheck service charge statements for errorsDetect cheaters by their gameplay behaviourDetect market manipulation on trading platformsDetect money laundering patterns in account activityDetect serial defects in fleet data before a recallFind duplicate and suspicious incoming invoicesIntercept fraudulent orders and card paymentsReview client bookkeeping for audit risks in advanceSelect tax cases for review on a risk basisStop fraudulent calls and SIM swap fraudTrack down electricity theft and tampered meters
‹ PreviousSee all use casesNext ›

A-082 · Legal status 08.10.2026