Fromensics: Investigate Email Senders

Investigate suspicious Gmail or Outlook on your device. Local AI builds an evidence report. The email never leaves the browser.

Fromensics checks a suspicious email before you pay, reply, or click. It works in Gmail and Outlook on the web, and it runs on your device. The email never leaves your browser. Invoice fraud works by changing one detail in an email that looks like it came from someone you trust: a bank account, a sender address, a link. Fromensics looks for exactly that, tells you what to do in one line, and shows you how it knows. WHAT’S NEW IN 0.1.7 • A calmer side panel. Every report gives one answer (Don’t pay, Check first, or Nothing looks off) with one reason and one next step. • Check sender now sits under the sender in Gmail and Outlook and shows the answer right there. • Ask about this email. Tap a suggestion or type a question, and Chrome’s built-in AI answers from the evidence on this device. • Check once. When a check needs the internet, you decide. Only the domain is sent, and the report shows what was looked up. • Four-word fingerprints for new signing keys, a quieter signature footer, and a clear “This email was changed” screen. • Right-click selected text or a link and choose Check with Fromensics, or press Alt+Shift+F to check the email that’s open. HOW IT WORKS Open a message and click Check sender. Fromensics reads that open message on your device (sender, subject, body, and links) and shows the answer in the side panel. It does not use the Gmail API or Microsoft Graph and does not ask for Google or Microsoft account access. • Don’t pay: a lookalike address, a new bank account, or a signature that no longer matches. One button writes to the address you already have for them, not the one the email came from. • Check first: something needs a second look, such as a brand-new domain or a link that goes somewhere other than it says. Check once, or let Fromensics always check. • Nothing looks off: no warning signs were found. Fromensics never calls an email “safe”, and you can add the sender to your trusted senders. • What it asks: the amount, what it’s for, and where the money goes, pulled out so you can compare it with what you expected. • How we know: every finding, and every check that could not run, is listed. Nothing is hidden and nothing is guessed. The answer comes from rules, not AI. Authentication, domain alignment, lookalikes, payment details, feed matches, and signatures are all checked in code. Chrome’s on-device AI (Gemini Nano) only explains the evidence. It cannot change the answer, and if it is not available, the rules still check every email. SIGNED EMAIL: KNOW IT’S REALLY THEM A hijacked mailbox can send a perfect-looking invoice. It cannot sign one with a key it does not have. • Turn on signing and Fromensics creates an Ed25519 key in this browser. The private key cannot be exported, is never synced, and is never sent to Fromensics. • Your emails get a short footer that covers what matters in a payment: sender, recipients, subject, links, bank details, and amounts. If any of them change on the way, the check fails and Fromensics says Don’t pay. • The first time a contact’s key appears, Fromensics shows four words. Call them on a number you already have and compare. Only then is the key trusted. • Verified email tells you, by name, that it’s really them. A changed key or a bad signature is flagged in red. Signing proves who sent it; it does not encrypt the email. • Anyone can check a signature at fromensics.com/s. The signature stays in the part of the link that is never sent to our server. SINGLE PURPOSE Single purpose: check the email you choose, and verify signed email, on your device. Fromensics is not a page scraper, an email exporter, or an inbox scanner. If you turn on trust badges, it reads only the visible sender address in your Gmail inbox list. The right-click check reads only the text or link you selected. PRIVACY BY ARCHITECTURE • By default, the email body, subject, and recipients never leave your browser. • Online checks happen only when you choose Check once or turn on automatic checks. They send one indicator (a domain, link host, or name) to DNS-over-HTTPS, RDAP, or, with Pro, https://proxy.fromensics.com (which may query Brave Search). Never the email. Every lookup is listed in the report. • The optional license check sends only the license key and extension version. • Chrome’s on-device AI runs inside Chrome. Chrome may download the model. Fromensics servers do not receive the email. • The last investigation may be stored in Chrome extension storage on this computer, along with your history, trusted senders, and keys. You can erase all of it in Settings. We do not run a central database of emails, keys, or contacts. PRICING Investigating a sender is free. You do not need an account. Signed email and trusted senders are free too. Optional Fromensics Pro is $5.99 a month, sold by Fromensics on Whop (not by Google). Pro adds deeper online checks through our privacy proxy, site and sibling-domain checks, web and LinkedIn search (30 investigations a month), premium feed coverage, and longer local history. Fromensics is a DBA of Zima Media OÜ (Estonia). It is for people who move money over email and want to check a suspicious message, or prove their own are genuine, without sending anything to a third-party scanner. Privacy policy: https://fromensics.com/privacy/ Terms of Service: https://fromensics.com/terms/ Limited Use: https://fromensics.com/limited-use/