What the colored banner on a message means

Above each message from someone else, Turtini says what it knows about the sender. Press Why? to see every reason.

- Red means a specific deception: the domain is spelled to look like one you trust (your own, a partner organization's, a company in your CRM, or a well-known bank or brand), the display name copies someone in your organization from an outside address, the sender's own domain says the message did not come from them, or your organization or Turtini has blocked the sender.
- Amber means take a second look: a first message from a domain registered in the last few months, replies that would go to a different domain, a business name from a personal email account, or a link that names one site and opens another.
- Green names a relationship, and only when the receiving server confirmed the sender's domain: your organization, an accepted partner organization, a contact in your CRM, or someone you have written to. It is about who sent it, not a promise about what it asks.

The colored dot next to each conversation in the list is the same check on the sender alone.

If a message asks you to change bank or payment details, pay a new account, wire money urgently or buy gift cards, you also see a payment warning. When the sender is a vendor or CRM contact you know, the warning shows the phone number already on file. Call that number, not one from the message, before changing anything. A bank-details change for a vendor made soon after such a message is flagged on the vendor in Accounting.