The most common reasons a message gets a banner:
First-time sender
you’ve never received email from this address before.
Name doesn’t match the address
the display name says one thing (for example, your boss or a known company) but the actual email address tells a different story.
Lookalike domains
addresses designed to imitate a real one, like swapping a letter or adding an extra character to a familiar company name.
Failed sender verification
the email claims to be from a domain but doesn’t pass the checks that prove it.
Suspicious links
links that lead somewhere other than where they appear to, or to known-bad sites.
Risky requests
messages pushing you to send money, buy gift cards, change banking or payroll details, or hand over a password, especially when they pressure you to act fast or keep it quiet.
Brand impersonation
fake notices pretending to be Microsoft, DocuSign, a bank, or a courier to trick you into signing in or clicking.