Customs / How it works
Customs reviews Microsoft 365 email for signs of phishing and invoice fraud. Your team sees what triggered a warning and decides how to respond.
Start with one inboxSign in to your Microsoft organization and have an authorized administrator grant the requested permissions. Customs verifies the connection before setup can continue.
Select the inboxes that receive invoices, payment requests or sensitive correspondence.
Record each vendor’s name and expected sending domains. Customs compares those details with the message’s claimed identity, authentication results and sender history.
The engine combines domain mismatches, lookalike links and requests involving credentials or banking changes. The dashboard shows the assessment and its reasons.
“No red flags” means these checks did not find a warning. It does not authenticate a payment or certify a message.
Free accounts review verdicts on the dashboard. Pro and Business can enable categories, warning banners, movement to a review folder.
Actions are optional. An administrator chooses them in Account & settings.
Microsoft 365 connection
Microsoft’s consent screen is the source for the permissions requested by the Customs app. Depending on the feature, these include reading email, changing message categories or content, moving mail, reading mailbox settings and sending digests.
Application permissions can cover more mailboxes than those selected inside Customs. An administrator can use Microsoft’s supported application-access controls to limit access. Customs’ mailbox selection determines what this service scans; it is not itself a Microsoft permission boundary.
Processing & limits
Selected email is processed on LabCMD’s servers. The service stores message metadata, verdicts and reasons for review history. Rule-based detection does not require a language model. If an operator enables the optional LabCMD-hosted model, an excerpt may also be processed to explain a flagged message.
Customs inspects available sender, content and link signals. It is not an attachment sandbox or a guarantee against fraud. Keep your existing security controls and independently verify payment changes.
