After two decades in IT, consulting with hundreds of businesses across every industry, I've seen a lot. Network outages, data breaches, ransomware attacks, compliance nightmares. But you know what I saw more than anything else?
Someone standing in a doorway, holding their phone or pointing at their screen, asking: "Hey… is this email real?"
Every time, no matter the company size or the technical sophistication of the team, people had that moment of doubt. The nervous laugh. The slight embarrassment, like they should already know the answer.
And every time, I told them the same thing: there's no such thing as a stupid question when it comes to a suspicious email. Clicking the wrong link takes one second. Recovering from it can take months.
The Question Nobody Wants to Ask Out Loud
Here's what I noticed over 20 years: people aren't afraid of phishing emails. They're afraid of looking foolish for not recognizing one.
The smartest executives I've ever worked with — people running multimillion-dollar operations — would pull me aside quietly to ask about a sketchy email rather than forward it to their IT department. The stigma of "falling for it" is so strong that people would rather take a risk than admit they weren't sure.
That always bothered me. Because the truth is, the best phishing emails today are designed to fool smart people. They're not the obvious Nigerian prince scams of 2005. They're coming from hacked accounts you recognize. From real-looking domains with one letter off. From free email services that fly right under the radar of even enterprise spam filters.
No spam filter catches everything. Not even close.
The Moment That Changed Everything
A while back, I was looking at a particularly convincing email — the kind that would give even a seasoned IT pro pause. On a whim, I copied the context of it and pasted it into one of the major AI tools, just to see what it would say.
I was blown away.
The analysis was sharp, detailed, and explained why the email was suspicious in plain English. No jargon. No condescension. Just a clear, calm breakdown that any normal person could understand and act on.
That was the moment Mail P.I. was born.
Building It: The Hallucination Problem
I spent weeks — honestly, hundreds of hours — building the first version. And early on I ran into a real problem: AI hallucinations.
Sometimes the analysis would go slightly off the rails. It would fixate on something benign or miss a key red flag. Any single AI model, no matter how good, can occasionally go down the wrong path.
So I did what any good investigator would do: I got a second opinion.
Mail P.I. now runs every email through two independent AI systems. They analyze separately, and their findings are cross-referenced. If one goes off track, the other keeps it honest. Together, they produce something I found genuinely impressive — a risk score and plain-language explanation that works as a reliable guide for the average person.
The more I tested it, the more excited I got. I found myself actually hoping to come across a well-crafted phishing example so I could put Mail P.I. through its paces. It got good at spotting the subtle stuff: the slightly-off sender domain, the urgency tactics, the mismatched links hiding behind legitimate-looking text.
The Best Phishing Emails Don't Look Like Phishing Emails
This is the thing that most people don't realize, and it's why traditional spam filters keep failing.
The most dangerous emails today don't come from obvious sources. They come from compromised legitimate accounts — your vendor's email, a colleague's personal Gmail, a supplier you've worked with for years. The attacker hijacks a trusted identity and uses it against you.
Spam filters look at technical signals. They check domain reputation, SPF records, known malicious patterns. But when a real account gets hacked, those signals often look perfectly clean. The filter waves it through.
What you actually need is something that reads the intent of the email — the psychology behind it, the subtle manipulation tactics, the inconsistencies in the story being told. That's what AI does well. That's what Mail P.I. does.
No App. No Signup. Just Forward It.
I wanted Mail P.I. to be as frictionless as possible — because I know from experience that if something requires effort, people won't use it in the moment they need it most.
So the mechanic is dead simple: forward the suspicious email to check@mailpi.app. That's it. You get an instant AI risk report back — a 0–100 risk score, a clear summary, and specific reasons why the email is or isn't a threat.
No app to install. No account to create for your first scan. Works from any device, any email client, anywhere in the world.
Because when someone's staring at a sketchy email trying to decide whether to click, they don't need friction. They need a fast, trustworthy answer.
For the Person Who Just Wants to Know
Mail P.I. isn't built for security professionals. It's built for the person standing in the doorway, slightly embarrassed, asking if the email is real.
You shouldn't have to feel stupid for not knowing. You shouldn't have to bother your IT department (if you even have one). And you definitely shouldn't have to just guess and hope for the best.
Twenty years of IT taught me that the most valuable thing I ever offered wasn't technical expertise — it was being someone people felt safe asking. Mail P.I. is my attempt to bottle that up and make it available to everyone, any time, for free.
Got a suspicious email? Forward it. We'll investigate.