Email security for finance & AP teams

Know which emails your team can trust.

Customs is a second set of eyes on every invoice, payment request, and login email. It reads each one the way a security analyst would — then tells you, in plain English, whether it's safe to act on.

No AI required — fully deterministic Nothing leaves your tenant Every verdict explained Set up in minutes

How Customs works

Connect once. Customs does the rest — automatically, on every new email that arrives.

1 · Connect
One approval connects your Microsoft 365 — no passwords, no mailbox changes, no forwarding.
2 · It watches
Customs reads every new message in the inboxes you choose, automatically — around the clock.
3 · It investigates
It verifies the sender's real identity, follows the links, and reads the intent — the way an analyst would.
4 · Plain verdict
Clear, Caution, or Malicious — with the two or three reasons spelled out in plain English.
5 · In your inbox
A warning label, a banner, auto-move to a review folder, or a daily digest — whatever you choose.

What it catches

The attacks that actually cost finance teams money — not just spam.

Login & brand phishing

Fake Microsoft 365, Apple, and DocuSign logins, and lookalike senders like lCIoud → iCloud that slip past the spam filter.

Invoice & payment fraud

A vendor “changing their bank details,” or a fake invoice from the wrong domain — checked against the vendors you actually pay (BEC).

Hidden & disguised links

Unwraps shortened and redirect links to their true destination and flags when the link text doesn't match where it really goes.

See Customs in action

Three real-world emails — two are attacks, one is genuine. Click each one. This is exactly what your team sees.

⚠ What lands in the inbox

Customs verdict

✕ Malicious95% confidence · score 102
Why it was flagged — in plain English:
vendor impersonation +50
Apex Supplies is a vendor you pay — but their real domain is apex-supplies.com. This came from apex-supplies-billing.com, a cousin domain built to look right.
banking-change request +40
Asks you to redirect payment to a new bank account — the core of business email compromise. Customs always treats a vendor + new-bank-details combination as hostile until verified.
first contact +12
This exact sender has never emailed your team before.
Why this matters: the fake-vendor banking change is the single most expensive email scam for U.S. businesses (the FBI logs billions in BEC losses every year). Customs catches it because it knows which vendors you actually pay — and which domains are really theirs.

⚠ What lands in the inbox

Customs verdict

✕ Malicious99% confidence · score 85
Why it was flagged — in plain English:
brand impersonation +45
Claims to be iCloud, but was sent from notifications.greythr.com (not apple.com / icloud.com).
auth misalignment +30
Passes email auth — but for greythr.com, not iCloud. A valid signature ≠ a legitimate sender.
urgency / credential +10
Pressure language (“verify immediately,” “final reminder”) typical of credential phishing.
This one is real: it's the first phish Customs ever caught in production — it had already sailed past Microsoft's filters because, technically, nothing about it fails authentication. The mismatch between the brand and the authenticated sender is what gives it away.

✓ An everyday invoice — left untouched

Customs verdict

✓ Clear90% confidence · no signals
No red flags found — safe to act on. (Not a guarantee; Customs re-checks if anything changes.) What it verified:
sender authenticated
SPF, DKIM and DMARC all pass and align with contoso.com — the vendor's real domain.
known vendor
Matches a vendor you actually pay; no lookalike domain and no banking-change request.
links clean
The only link goes to contoso.com — no redirect, shortener, or text/destination mismatch.
Just as important: Customs leaves real mail alone. No quarantine purgatory, no second-guessing every receipt — your team only hears about the mail that deserves a second look.

Protect your inbox in minutes.

Free for one inbox. Upgrade when you want Customs to label, move, and digest automatically. Cancel anytime.