What's changed

Stopped warning about things that were fine

• Brand names inside ordinary words. A domain containing the letters of a brand anywhere in it was treated as impersonation, so combattextiles.com looked like AT&T and groups.io looked like UPS. A brand now has to sit on a boundary in the address, not inside a longer word.
• Reference numbers read as phone numbers. A twelve-digit eBay item ID contains a ten-digit run, and that run was being reported as a fake support line. Numbers behind a label — item, order, tracking, invoice — are now left alone.
• Companies acting on another company's behalf. A retirement statement sent by the plan administrator names the employer, which read as impersonation. That shape is now recognised for what it is.
• A confirmed sender's own links. Marketing platforms hang tracking links off odd-looking subdomains of the sender's own domain. Once the sender is confirmed, their own domain is theirs.
• Shared mail infrastructure. Small businesses sending through Constant Contact, Mailchimp and similar are no longer penalised for their provider's domain.
• Brands' own marketing domains. hulumail.com and its like are no longer treated as forgeries.

Started catching things it was missing

• Your provider's own verdict. If the message is already in spam or junk, Stonephish now says so rather than starting from nothing.
• Fake receipts from personal accounts. A renewal notice on company letterhead sent from a free email account, with a support number that isn't theirs.
• Crypto reward lures. These now flag regardless of who sent them — the payload sometimes rides inside a genuine newsletter's confirmation email.
• Borrowed mail-service names. A domain dressed up to look like email plumbing without being it.
• Long random subdomains. Scored by length now, so a thirty-character string of consonants is treated as what it is.
• Free hosting. Pages put up on free platforms in minutes under any name.

Changes you can see

• Badges in the Gmail message list, not only inside an opened message.
• Control over how many badges you see — everything, warnings only, or none. Warning banners always appear whichever you choose.
• "I know this sender" on any warning, so you can quiet one you disagree with. Money warnings still come through — a trusted account that starts asking for gift cards is exactly what you need telling about.
• Unsubscribes can be ticked off once you've finished them.
• Unreadable QR codes now say so rather than staying silent.
• Attachments are checked on every supported mail service, not only Gmail.

• The true destination of every link, shown before you click.
• Senders checked against the real sending domains of hundreds of banks, retailers, couriers and government agencies.
• Phone numbers checked against the company's genuine support line.
• Payment requests that can't be undone — and the pressure that comes with them.
• Links hidden inside QR codes and PDF attachments.
• Runs entirely on your device. No account, no server, no network requests.