Five things we learned building scam detection into an Outlook add-in

A developer behind OutlookDog, an AI-powered Outlook add-in for email scam detection, shared five engineering lessons from a year of building on the Office add-in platform. The team found that users respond to plain-language warnings over protocol terms like SPF failures, and that a read-only add-in incapable of sending, deleting, or moving mail resists prompt injection and malicious-email manipulation. The tool flags spoofed trusted senders even when users safelist them and shows specific red flags to cut false-positive complaints.

Disclosure: we build OutlookDog, an AI add-in for Outlook — this post is the engineering lessons, not a pitch. After a year of building email-safety features on the Office add-in platform, here are five lessons that might help anyone working in this space. Users don't act on "SPF fail" — they act on "this sender looks like your vendor but isn't." We demoted every protocol term to a footnote and warnings started working. An add-in that can't send, delete, or move mail can't be tricked into doing any of those things — by a user mistake, a prompt injection, or a malicious email pretending to be a rule. It's also the difference between "please approve this add-in" going well or badly with an IT team. A message that fails identity checks gets warned about even if the user marked that sender safe — the spoof of a trusted sender is exactly the mail the safelist would otherwise wave through. We tuned toward warn-and-explain: every flag shows its specific red flags so the user can judge in seconds. False-positive complaints dropped when the reason became visible, not when the warnings got rarer. For a title company, a closing practice, a property manager — one caught "updated wiring instructions" email pays for a decade of any tool. That's the email to design for, not the lottery-scam strawman. Happy to go deeper on any of these in the comments. We build OutlookDog https://outlookdog.com and launched it on Product Hunt this week.