When you forward a message to us, it is analysed automatically within seconds. Here are the checks we run, without the technical details.
Page updated on 9 November 2026
An address can display any name. We check where the message really comes from.
The address’s domain (what follows the @) must exist and be set up for e-mail. A domain that does not exist is a strong warning sign.
Fraudsters often register a domain name a few days before sending. We check the official domain name registry.
When you forward the message as an attachment, we read the checks your mailbox made on arrival: they tell whether the displayed domain really authorised the sending.
A display name that does not match the address, replies redirected to another address, a domain imitating your company’s or that of someone in the conversation.
Fraudsters pose as organisations everyone knows. We know their real domains and their usual traps.
A message that claims to come from one of these services without coming from its official domains, or whose links lead elsewhere, is flagged.
Services we watch: Apple, Argenta, Bancontact / Payconiq, Banque-Carrefour des Entreprises (SPF Économie), Belfius, Beobank, BNP Paribas Fortis, Booking.com, bpost, Card Stop, Crelan, CSAM, De Watergroep, DHL, DNS Belgium, Doccle, DPD, eBox, Eneco, ENGIE, Europol, Farys, FedEx / TNT, Fluvius, GLS, Helan, INAMI / RIZIV, ING Belgique, Interpol, Isabel, itsme, KBC / CBC, Keytrade Bank, Luminus, Microsoft 365, Moniteur belge, Mutualité chrétienne, Mutualité libérale, Mutualités Libres, mypension.be (Service fédéral des Pensions), Netflix, notaire.be (Fednot), ONSS / RSZ, ONVA / RJV (pécule de vacances), Orange Belgium, ORES, Partenamut, PayPal, Police fédérale, PostNL, Proximus, Scarlet, Sibelga, Solidaris, SPF Finances / MyMinfin, SWDE, Telenet, TotalEnergies, UPS, Vivaqua, VOO, WeTransfer.
A parcel held at customs, a bank card about to expire, a refund from your health insurer or the tax office, an unpaid bill with a threat of cut-off… The report says when a message follows one of these scenarios.
The Computile team follows Safeonweb alerts and records ongoing campaigns. A message that looks like one is flagged, with a link to the alert.
We never open the pages: we look at where the links lead and what is known about those sites.
A shortened link or a redirect (through Google, Facebook, LinkedIn, a security gateway…) can hide the real destination. We find it.
Each destination is compared with the lists of dangerous sites published by the security organisation abuse.ch (URLhaus, ThreatFox).
A link to a domain imitating a brand (be1fius-secure.com), registered very recently, or hosted on a free platform while the message asks for your details or a payment.
Files are never opened or run: we read their name, their fingerprint and their content as text.
Programs, scripts, disk images, OneNote notebooks, web pages, documents with macros, and disguised names such as “invoice.pdf.exe”.
Each file’s fingerprint (a kind of barcode) is compared with abuse.ch’s MalwareBazaar database. The file itself is not sent.
Links in PDFs and calendar invitations, fake sign-in pages in web files, the content of ZIP archives (even password-protected ones), macros and content loaded from the internet in Word, Excel and PowerPoint documents.
Urgency, requests for personal data or codes, payment requests, a vague subject: they are gathered in the Safeonweb checklist of your report.
A foreign account, cryptocurrency, an announcement of new bank details, an IBAN or structured reference whose check digits are wrong.
Invisible text, hidden characters inside words, letters from another alphabet imitating ours, a message reduced to a clickable image.
A fake purchase to cancel by phone, CEO fraud, a fake police summons, a conversation taken over from an imitated address, a fake reply to an exchange that never happened.
Each finding weighs in the verdict. Some are enough on their own to conclude there is a threat (known malware, a domain imitating a brand); others make the message suspicious; with no finding, the report says “no warning sign”.
A well-crafted scam can slip through. If a message asks you for a payment, a password or a code, always check through another channel.
We do not read QR codes or text inside images. RAR or 7z archives are not opened. A regular forward loses the authentication details: forward the message as an attachment for a full analysis. When an outside service does not answer, the report says so.
We rely on advice and alerts from Safeonweb (Centre for Cybersecurity Belgium), the databases of the security organisation abuse.ch, official domain name registries.
The message is deleted within 24 hours, and the report after 7 days. Privacy policy