EmailCheck.AI User Guide
Learn how to effectively use EmailCheck.AI to identify phishing and other suspicious emails.
Written by Bradley Riley
Updated at August 13th, 2026
Table of Contents
EmailCheck is an AI-powered service from Bigger Brains that helps you identify phishing and other suspicious emails. This guide explains what the app does, how to install it, and the two ways you can use it day-to-day.
Important: AI Disclaimer
Every EmailCheck analysis is generated by AI and may be inaccurate. Treat the verdict as a second opinion, not a final ruling. If you are unsure about an email, especially one that asks for credentials, money, or unusual access, contact your IT Department, IT Support Provider, or contact us at support@emailcheck.ai before taking action.
What EmailCheck Does:
EmailCheck reviews a suspect email and tells you whether it looks legitimate, suspicious, or a likely phishing attempt. Instead of guessing at red flags on your own, you get a structured second opinion that explains what the AI saw and a short interactive quiz to help you recognize similar threats in the future.
EmailCheck inspects several aspects of each message, including:
-
Sender Authenticity:
- Is the sending domain consistent with the brand it claims to be?
-
Link Integrity:
- Do the links go where they appear to go, or are they obscured by trackers and redirects?
-
Urgency:
- Is the language of the email intended to make you act quickly, without thinking about the consequences?
-
Request Reasonableness:
- Is the email asking you to do something unusual, urgent, or out of character?
-
Impersonation Indicators:
- Is the email pretending to be from a person or company it isn't?
-
Content Patterns:
- Does the writing match common phishing playbooks?
Key Features:
Feature |
What it Does |
| Risk-level Verdict | A clear rating (e.g. safe, suspicious, likely phishing, definite phishing) so you know at a glance whether to trust the email. |
| Analysis Findings | Plain-language explanations across sender authenticity, link integrity, request reasonableness, and impersonation indicators. |
| Report and Block (side pane) | Reports the message and blocks the sender using Microsoft Graph. The first use may prompt for admin consent. |
| Interactive SLURP Quiz | A short (2–3 minute) quiz that walks you through the red flags in the email, so you build phishing-detection skills as you work. |
| AI Disclaimer | Every analysis ends with a reminder that results are AI-generated and may be inaccurate. Confirm with IT before acting on a high-risk verdict. |
Two Ways to Use EmailCheck:
You can analyze a suspicious email in either of two ways. The Outlook side pane is the recommended option.
Option A: Outlook (or Gmail) Side Pane
- Open the suspicious message in Outlook (desktop, web, or mobile) or Gmail.
- Click the EmailCheck add-in icon in the menu.
- Answer the SLURP quiz, identifying potential reasons you believe this email is suspicious (or not).
- Select Submit for Analysis.
- Wait a few seconds while EmailCheck analyzes the message.
- The side pane will display the risk level, its analysis of the SLURP factors, and detailed findings.
- Review the findings and summary to understand why the email was rated the way it was.
- If the message is suspicious, click Report and Block in the side pane to report or block the sender.
Please Note:
The teachable moment (SLURP quiz) is limited to 20 uses per day per user; after that, the EmailCheck tool will just return the Analysis results without the quiz.
Option B: Forward to test@emailcheck.ai
Please Note:
Forwarding the message to any email address ending in @emailcheck.ai will be accepted, not just test@emailcheck.ai. Additionally, the Forwarded-Email methodology is less accurate than the Outlook or Gmail plug-ins because it does not have access to the raw email headers
If you can't use the side pane (for example, on a device without the add-in installed), you can forward the suspect email to EmailCheck instead.
- Forward the email as an attachment, or inline, to test@emailcheck.ai.
- Within a few minutes, you will receive a reply from EmailCheck containing the risk level, a summary, and a link to the interactive quiz.
- Read the analysis and act accordingly.
Please Note:
If you don't have an active EmailCheck subscription, you will receive a short sales message instead of an analysis.
The SLURP Framework Overview:
SLURP is a mnemonic for five phishing checkpoints that users can learn and remember:
Letter |
Checkpoint |
User Question |
S |
Sender Authenticity |
Is the email address actually from who it claims to be? |
L |
Link Integrity |
Do the links go where they claim to go? |
U |
Urgency & Pressure |
Is the message creating artificial time pressure? |
R |
Request Reasonableness |
Are they asking for something sensitive or unusual? |
P |
Pretense & Impersonation |
Are they impersonating a known brand, person, or authority? |
Please Note:
A sixth checkpoint, Polish & Professionalism, evaluates email quality (grammar, formatting, branding) but is weighted lower due to AI-generated phishing improvements.
Traffic Light Scoring System:
Each checkpoint produces a three-level assessment:
Level |
Meaning |
User Implication |
| 🟢 Green | No concerns detected. |
This indicator looks normal. |
| 🟡 Yellow | Suspicious elements. |
Warrants caution. Verify independently. |
| 🔴 Red | Strong phishing indicator. |
Likely malicious. Do not engage. |
Please Note:
The overall verdict logic is as follows:
- Safe: All checkpoints are green.
- Suspicious: At least one yellow flag, no red flags.
- Likely Phishing: One red flag.
- Definite Phishing: Two or more red flags, or one severe red flag combined with supporting indicators.
Installing the EmailCheck Plug-in:
EmailCheck is currently available in the Microsoft Marketplace as an Outlook plug-in. This plug-in can be installed by individuals or organizations.
View Plug-in in Microsoft Marketplace
Please Note:
- Updated installation information is always available at www.emailcheck.ai.
- EmailCheck is coming soon to the Google Workspace Marketplace. View in Google Workspace Marketplace.
- If necessary EmailCheck is available as a side-loadable manifest file, contact support@bigger-brains.com for more information.
Subscriptions & Licensing:
EmailCheck is available as an add-on through the Bigger Brains Reseller Program. An active EmailCheck subscription is required for your team to receive AI analysis. Currently, it is exclusively available through our MSP / ITSP partners and select Training companies. Users without an active subscription who forward an email to test@emailcheck.ai will receive a brief sales message in place of analysis.
Please Note:
EmailCheck is exclusively available through our MSP / ITSP partners and select Training companies. If your current Bigger Brains partner does not offer EmailCheck, contact support@bigger-brains.com.
Reseller Branding:
Resellers can customize the look of EmailCheck for their customers:
- Access the Reseller Portal.
- Go to the Themes tab.
- Upload your logo.
- The logo will appear in EmailCheck for your customers.
- Remove the logo at any time by clicking Remove Logo.
Data Privacy:
Please Note:
For updated Data Privacy information, please view the following:
- Privacy Policy
- Subprocessor List
- Terms and Conditions
- MSA, DPA, & Addendums
Data Privacy is of utmost importance to Bigger Brains, and EmailCheck has been developed with privacy and data minimization as our fundamental principles.
The EmailCheck platform only receives emails that are submitted by users. Each email is processed by an enterprise-grade AI platform (currently Claude Haiku) which does not use any user data, prompts, or responses in its training. After AI processing, the body of the email is discarded, while the sender, subject line, date, time, and the summary analysis are saved for reporting and feedback purposes.
No information received is used to train AI models.
Feedback: In the results pane, EmailCheck offers a thumbs up / thumbs down feedback option to help us guide future development. However, this information is not directly used in any AI training, but rather is reviewed by our (human) developers for trends or errors so we can adjust our own prompts and guiderails in the future.
Currently, all data processing is done in the USA, in the Azure East data center, and using Anthropic’s APIs. GDPR Compliance is available via an appropriate Data Processing Agreement; contact support@bigger-brains.com for details. Future expansion to include an EU-only data processing option is under consideration.
Getting Help:
If you have questions, issues, or feedback:
- Email support@emailcheck.ai.