# Five things we learned building scam detection into an Outlook add-in > Source: > Published: 2026-09-15 16:53:38+00:00 *Disclosure: we build OutlookDog, an AI add-in for Outlook — this post is the engineering lessons, not a pitch.* After a year of building email-safety features on the Office add-in platform, here are five lessons that might help anyone working in this space. Users don't act on "SPF fail" — they act on "this sender looks like your vendor but isn't." We demoted every protocol term to a footnote and warnings started working. An add-in that can't send, delete, or move mail can't be tricked into doing any of those things — by a user mistake, a prompt injection, or a malicious email pretending to be a rule. It's also the difference between "please approve this add-in" going well or badly with an IT team. A message that fails identity checks gets warned about even if the user marked that sender safe — the spoof of a trusted sender is exactly the mail the safelist would otherwise wave through. We tuned toward warn-and-explain: every flag shows its specific red flags so the user can judge in seconds. False-positive complaints dropped when the *reason* became visible, not when the warnings got rarer. For a title company, a closing practice, a property manager — one caught "updated wiring instructions" email pays for a decade of any tool. That's the email to design for, not the lottery-scam strawman. Happy to go deeper on any of these in the comments. We build [OutlookDog](https://outlookdog.com) and launched it on Product Hunt this week.