> Enrich.chat gives AI agents verified work emails and mobiles. To use it from an agent, read https://enrich.chat/agents.md . This is the Markdown version of https://enrich.chat/blog/who-owns-this-email-address/

# Who owns this email address? What you can find out for a work email, and what you cannot

A work address leads to a company and often to a role. A personal mailbox leads to its provider and no further. Here are the safe checks for a suspect message, where to report phishing, and the lawful way to look up a work email.

By Enrich.chat Editorial. Updated October 16, 2026.

**Short answer:** The domain after the @ shows who runs a work address, and a work-email lookup can often add the person's role and company. A personal mailbox such as Gmail has no public owner record: [ICANN's lookup](https://lookup.icann.org/en) covers domains, not mailboxes. If you doubt a sender, read the message's authentication results, then confirm by phone through the company's official switchboard.

## Key takeaways

- A work address names a company through its domain. A lookup can add a role, but it shows who the address belongs to in records, not who sent a given message.
- SPF, DKIM and DMARC results are evidence about a sending domain. RFC 9989, published in May 2026, says DMARC does not address lookalike domains or display-name abuse.
- Domain age is a flag, not a verdict. In a June 2026 preprint on 1.52 million flagged domains, the median attacker-registered domain was 60 days old when first detected, and 10.7% of flagged domains were long-established sites taken over.
- Phishing and spoofing was the most reported crime type to the FBI's IC3 in 2025, with 191,561 complaints. Business email compromise cost $3.05 billion in reported losses.
- If you use a match, you may owe the person a privacy notice. GDPR Article 14 sets the latest time at one month after you obtain the data, or at your first message.

## Who owns this email address, and what can you find out?

It depends on the kind of address. A work address such as name@company.com names a company through its domain, and often a role through the company's own pages or a work-email lookup. A personal mailbox such as name@gmail.com names only its provider, and no public registry links it to an owner.

[ICANN's registration data lookup](https://lookup.icann.org/en) shows why. It covers domain names and Internet number resources, not mailboxes. So this guide covers business addresses only. It does not explain how to identify or locate a private person from a personal address, and it leaves out people-search sites.

Figure 1 shows what each part of an address can and cannot tell you.

**Figure 1: What each part of an email address can tell you.** A fictional work address, dana.lee@example.com, is split into a local part and a domain. The local part may show a name pattern or a shared inbox and is never proof of who is typing. The domain shows who controls it through RDAP, the registrar and creation date, and the company's own website. Below, a personal mailbox such as name@gmail.com is marked stop: its domain names the provider, not the person, and no public record links a mailbox to its owner.

*What each part of an email address can tell you. The work address is fictional, on a domain reserved for examples. Domain registration data comes through RDAP, defined in [RFC 9083](https://www.rfc-editor.org/rfc/rfc9083.html), and [ICANN's lookup tool](https://lookup.icann.org/en) covers domains, not mailboxes.*

The local part, before the @, is the weakest clue. Many companies build addresses from one pattern, and our guide to [business email formats](https://enrich.chat/blog/email-address-formats/) lists the common ones. A pattern shows how an address is built, not who is typing. A role address such as info@ names no one: the European Commission lists name.surname@company.com as [personal data](https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en) and info@company.com as data that is not personal.

## What can you learn from each kind of address?

You can learn the most from a work address on a company domain and the least from a personal mailbox. The table lists what you have, what you can safely learn and what you must not do with it.

| What you have | What you can learn | What you must not do |
| --- | --- | --- |
| A work address on a company domain, such as dana.lee@example.com | The company, from the domain. Often the role, from the company's own pages or a work-email lookup. | Treat a match as proof of who sent a message, or send marketing to it without checking the rules. |
| A role address such as info@ or sales@ | The team or function. No person. | Hunt for a name behind it. |
| A personal mailbox such as Gmail, Outlook.com or Yahoo | The provider only. | Use people-search sites, social-media matching or any other method to identify or locate the owner. |
| A domain you do not recognize | The registrar, creation date and status from RDAP, and whether it matches a real company's site. | Judge by age alone. A new domain is a flag, and an old one is not a clearance. |
| A message you received | SPF, DKIM and DMARC results, and the domain they cover. | Click links, open attachments or call numbers from the message. |
| An address already in your CRM or a form fill | Role and company, by a work-email lookup. | Overwrite your records without checking, or contact the person without meeting the notice rules. |

The last column carries the safety rule. A lookup that helps you check a supplier becomes profiling when it is aimed at a private person. If a personal address sends you abuse or fraud, report it to the mail provider and the bodies listed below instead of trying to unmask it.

## What do SPF, DKIM and DMARC results prove about a sender?

SPF, DKIM and DMARC results show whether a message used a domain with that domain's permission. They do not show who typed it, and they do not show whether the domain is the company you think it is. Figure 2 sums up what each result proves and what it misses.

**Figure 2: What SPF, DKIM and DMARC each prove and miss.** Three rows. SPF passing shows the sending server is allowed by the domain in the envelope sender, but not that the visible From address uses that domain. DKIM passing shows a domain signed the message and the signed parts were not changed, but not that the signer matches the From address. DMARC passing shows the From domain lines up with a passing SPF or DKIM result, but it misses lookalike domains, display names and whether the mail is safe. A closing bar says a pass is evidence about a domain, never about a person.

*What an SPF, DKIM or DMARC pass shows, and what it misses. Sources: [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html), [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html) and [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html).*

**Where to find the results.** In Gmail on a computer, open the message and click the down arrow below the sender's name. [Google's help page](https://support.google.com/mail/answer/180707) says a "Mailed by" or "Signed by" line means the message is authenticated, and a question mark beside the sender's name means Gmail cannot confirm the sender is who they appear to be. In other mail apps, open the full headers and find "Authentication-Results", where a pass reads spf=pass or dkim=pass. Microsoft 365 records [SPF, DKIM, DMARC and a combined result](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo) in the same header.

**What each pass means.** [SPF](https://www.rfc-editor.org/rfc/rfc7208.html) checks the sending server against the domain in the envelope sender, the address that bounces go to, according to [Microsoft's header guide](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo). The RFC warns in section 11.2 that mail can pass SPF and still list other identities, such as a different From address. [DKIM](https://www.rfc-editor.org/rfc/rfc6376.html) separates the signer of a message from its purported author, so a valid signature names who signed, not who wrote. [DMARC](https://www.rfc-editor.org/rfc/rfc9989.html) then checks that the From domain lines up with a passing SPF or DKIM result.

**What a pass misses.** RFC 9989 says DMARC can only combat exact-domain spoofing and does not address visually similar domain names or abuse of the display name. It adds that a DMARC pass does not guarantee that delivery to the inbox would be safe. Google says the same in plain words: [spammers can also authenticate mail](https://support.google.com/mail/answer/180707), so authentication alone does not guarantee a message is safe. A fraudster who owns a lookalike domain can set up all three checks for it.

**One caution about the header itself.** [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html) says the mere presence of an Authentication-Results field does not mean its contents are valid, and its security section warns that a forged field can mislead a mail app. Trust the result your own mail provider shows you, not header text or a screenshot that someone sent you.

One date matters if you read older guides. RFC 9989, published in May 2026, obsoletes RFC 7489 as the DMARC specification, so a guide that cites RFC 7489 is out of date.

## What does a domain lookup show, and what does GDPR hide?

A domain lookup shows the registrar, the dates and the status of a domain. It often hides who registered it, because ICANN's rules require registrars and registries to redact personal data where the law demands it.

To run the lookup, open [ICANN's lookup tool](https://lookup.icann.org/en) and type only the domain, the part after the @. The tool uses RDAP, the protocol that replaced WHOIS. ICANN says gTLD registries and registrars have [not been required to offer WHOIS since January 28, 2025](https://www.icann.org/rdap), apart from .com, .name and .post. RDAP answers carry an "events" list, and [RFC 9083](https://www.rfc-editor.org/rfc/rfc9083.html) uses "registration" as the example action, so you can read the creation date.

The registrant is a different story. ICANN's [Registration Data Policy](https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy), effective August 21, 2025, sets the redaction rules in section 9.2. Where redaction is needed to comply with law, registrars and registries leave out values such as the registrant's name, street and phone. A registrar must then publish an email address or a web form that does not reveal the contact. On October 16, 2026 we ran RDAP queries for gmail.com. They returned a registrar, a 1995 registration date and a registrant marked as redacted, with a link to a contact form. Nothing in them named a mailbox owner.

Domain age helps, but it misleads when used alone. A June 2026 [preprint by Mashood and Nabeel](https://arxiv.org/abs/2606.11111) studied about 1.52 million domains that at least five VirusTotal engines had flagged between January and May 2026. Among attacker-registered domains with a known creation date, the median age at first detection was 60 days. Only 7.4% were flagged within one day of registration, and 29.9% within one week. About 10.7% of the flagged domains were long-established sites that attackers had taken over. The paper is a preprint, so treat the numbers as indicative. The lesson is that a young domain is a reason to look harder, and an old domain is not a reason to relax.

If you have a real legal or security need for hidden registrant data, ICANN's [Registration Data Request Service](https://www.icann.org/rdrs-en) lets people with a legitimate interest ask participating registrars for it. It does not promise disclosure. You rarely need it to judge a sender, and the next section shows what to do instead.

## How do you confirm that a sender, vendor or recruiter is real?

Confirm them through a channel you chose, not one the message gave you. The FTC's phishing advice says to contact a company through [a phone number or website you know is genuine](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams), not the number or link in the message.

People usually ask who owns an address for one of four honest reasons. Each has its own safe check:

- **Is this sender who they claim to be?** Read the authentication results, then compare the sender's domain with the company's official site.
- **Is this message a scam?** The FBI's Internet Crime Complaint Center logged [191,561 phishing and spoofing complaints in 2025](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), its largest category by count. Business email compromise drew 24,768 complaints and about $3.05 billion in reported losses, second only to investment fraud. The report says fraudsters get there by compromising email accounts, so an address that really belongs to a supplier can still send a fraudulent request.
- **Who is this vendor or recruiter?** The FTC advises [searching the company's name with the word scam](https://consumer.ftc.gov/articles/job-scams) and never paying for the promise of a job. The IC3 report counts 24,688 employment complaints and about $363 million in reported losses for 2025.
- **Is this a customer or lead in my CRM?** Check your own records first, then use a work-email lookup, covered below.

For the first three questions, four steps cover most cases:

1. **Find the official site yourself.** Search for the company's name and open the result, not a link in the message. Compare the site's domain with the sender's, character by character.
2. **Look for the person or team on the company's own pages.** A team, leadership or press page can confirm a role. A missing name proves nothing, because staff pages are incomplete. Our guides to [finding decision makers](https://enrich.chat/blog/decision-makers-in-a-company/) and [finding a CEO's email](https://enrich.chat/blog/find-ceo-email/) cover role-based searches.
3. **Call the switchboard from the official site.** Ask for the person or the department. Do this before you act on a payment change, a new bank account or a request for gift cards, and never use a number from the message.
4. **Hold personal and payment details** until step 3 is done.

## Where do you report a phishing email?

Report it to your mail provider first, then to a national body. Reporting does not always block the sender, and most of these bodies say they cannot tell you the outcome. We read each page on October 16, 2026.

| Where | How to report | What the body says |
| --- | --- | --- |
| [Gmail](https://support.google.com/mail/answer/8253) | Open the message, choose More, then Report phishing. | Moving a message to Spam sends a copy and its attachments to Google for analysis. |
| [Outlook](https://support.microsoft.com/en-us/outlook/mail/phishing-and-suspicious-behavior-in-outlook) | Select the message, choose Report, then Report phishing. | The sender is reported but not blocked. Add them to your blocked senders to stop their mail. |
| [Anti-Phishing Working Group](https://apwg.org/reportphishing/) | Forward the email to reportphishing@apwg.org, as an attachment if your app allows. | Members process reports. By submitting, you let APWG save the email in full. |
| [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/) (US) | File a report online. | Reports are shared with more than 2,000 law enforcers. The FTC cannot resolve your individual report. |
| [UK NCSC](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email) | Forward the email to report@phishing.gov.uk. | It can investigate and remove scam addresses and sites. It acts on every message but cannot tell you the result. |

Do not click links in a suspicious email before you report it. [The NCSC says so](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email), and it asks you not to report a crime this way. If you have lost money in England, Wales or Northern Ireland, it points you to Report Fraud, and in Scotland to Police Scotland on 101. In the US, [the FBI's IC3 describes itself](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) as the central hub for reporting cyber-enabled crime.

## How can you look up a work email with an API?

Send the work address to a contact API and read back the person's name, title and company. Enrich.chat does this with `GET /v1/person?email=`. It looks up work addresses only, and a miss means nothing came back, not that the sender is fake.

Use it for the CRM question: who is behind a form fill, a trial sign-up or an inbound reply. It is also one more signal about an unknown vendor, beside the checks above. Figure 3 shows a worked loop for a fictional address on example.com, a domain reserved for documentation.

**Figure 3: A safe agent loop for looking up one work email.** A fictional address, dana.lee@example.com, goes through four steps. Step one checks whether the domain is a work domain, and a personal mailbox such as Gmail stops the loop because it is not looked up. Step two sends only the address to the lookup. Step three asks whether a person was found, and if not the agent writes not found, guesses nothing and uses 0 credits. Step four reports the role, company and status as returned and confirms by phone through the company's official switchboard.

*A worked loop for one fictional work address. The agent stops on a personal mailbox, sends only the address, reports a miss as a miss and confirms by phone. Request and response shapes follow [Enrich.chat's agents.md](https://enrich.chat/agents.md).*

1. **Split the address.** Take the part after the @. If it is a personal mailbox provider such as gmail.com, stop. The API does not look those up, and neither should you.
2. **Send only the address.** The agent calls `GET https://enrich.chat/v1/person?email=dana.lee@example.com&fields=email,profile`, or the matching tool on the MCP server at `https://enrich.chat/mcp`. It sends no message text, no attachment and no other names. The free tier needs no key: 10 lookups a day per IP address, no signup. The agent paces requests at about one a second.
3. **Read the answer.** A match returns a name, title, company and the status of the email. A miss returns `found: false`, and nothing is used.
4. **Compare with what you can confirm.** Check the company on its official site and call its switchboard. The record says whom the address belongs to, not who sent your message.
5. **Report and stop.** The agent writes the result in one line, with the status as returned, and does not guess any missing field.

Here is the shape of a match. The person, company and address are fictional.

```
GET https://enrich.chat/v1/person?email=dana.lee@example.com&fields=email,profile

{
  "found": true,
  "name": "Dana Lee",
  "title": "Head of Procurement",
  "company": {"name": "Example Industries"},
  "linkedin_url": "https://www.linkedin.com/in/dana-lee-example",
  "work_email": {"value": "dana.lee@example.com", "status": "verified"},
  "credits_used": 10,
  "free_lookups_remaining": 9
}
```

And the shape of a miss. Nothing is used, and the agent writes *not found*.

```
{"found": false}
```

The email status has three values. `verified` means Enrich.chat's records mark the mailbox as verified. `catch_all` means the domain accepts every address, so the mailbox cannot be confirmed, and our [catch-all checker](https://enrich.chat/tools/catch-all-checker/) page explains the risk. `unknown` means no confirmation either way.

Keep four limits in mind:

- **Work addresses only.** A personal mailbox is refused, and a role address such as info@ names no person.
- **A miss is a miss.** It does not mean the address is fake or the sender is lying. It means nothing came back.
- **A match is not proof of identity.** It says whom the address belongs to in records. A compromised mailbox still belongs to its real owner.
- **Records age.** People change jobs, and a role can be out of date. Our guide to [B2B data decay](https://enrich.chat/blog/b2b-data-decay/) compares the published rates. Treat every contact as a strong lead, not a guarantee.

A found work email uses 10 credits and a miss uses 0. Checking 100 contacts uses at most 1,000 credits, which fits the Growth plan at $29 a month. See [pricing](https://enrich.chat/pricing/) for every plan. Paste this prompt into an agent that can call the API or the MCP server:

```text
Use www.enrich.chat to look up the work email [work email address]. Report the name, title, company and email status exactly as returned. If it is a personal mailbox such as Gmail, stop and say it is not looked up. If nothing is found, write not found and do not guess. Then list how I can confirm the sender through the company's official site and switchboard.
```

To connect it, add the MCP server at `https://enrich.chat/mcp` to a client that supports custom MCP servers, or let an agent that can send web requests read [enrich.chat/agents.md](https://enrich.chat/agents.md). The [install page](https://enrich.chat/install/) has steps for ChatGPT, Claude, Cursor and Codex. To check a whole CRM, see our guide to [CRM data enrichment](https://enrich.chat/blog/crm-data-enrichment/).

## What must you do with the details a lookup returns?

Treat a match as personal data. A name-based work address identifies a person, so privacy law applies even to business contacts. This is not legal advice, and no data tool makes your use compliant.

**GDPR and UK GDPR.** The UK regulator says a [name-based business address is personal data](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) even when the person acts in a business capacity, and the [European Commission](https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en) gives the same example. When you obtain data from a source other than the person, [Article 14](https://gdpr-info.eu/art-14-gdpr/) requires you to give privacy information within a reasonable period and at the latest within one month. If you plan to contact the person, the latest point is your first message. The [ICO's guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/when-should-we-provide-privacy-information/) says a publicly accessible source counts as a source other than the person, so public data does not remove the duty. The ICO marks its guidance on both topics as under review because of the Data (Use and Access) Act.

**Email marketing.** The ICO says UK rules do not require prior consent to market by email to a company, but sole traders and some partnerships are treated as individuals. In the US, the FTC says [CAN-SPAM makes no exception for business-to-business email](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business). You need your valid postal address in each message and must honor an opt-out within 10 business days. Our guides to [cold email data](https://enrich.chat/blog/cold-email/) and [buying email lists](https://enrich.chat/blog/buying-email-lists/) go further.

**Opt-out.** Anyone can ask to be removed from Enrich.chat at the [opt-out page](https://enrich.chat/opt-out/), and requests are processed within 15 days. Our [privacy notice](https://enrich.chat/opt-out/#privacy) says how we handle data.

## What does Enrich.chat's email lookup do, and what does it not do?

Enrich.chat's email lookup takes one work email and returns the person's name, title, company and an email status when it finds a match. It is a single lookup for business addresses, built for an AI agent to call.

- **It does** look up work emails, return a status on the email, use 0 credits when nothing is found, and work from one prompt in ChatGPT, Claude, Cursor and other agents.
- **It does not** look up personal mailboxes such as Gmail. It is not a people-search site for private individuals, and the email lookup does not build lists. There is no Chrome extension. It does not read your message, check headers or report phishing, so use the steps above for those.
- **It never** logs in to LinkedIn or uses anyone's LinkedIn account. A LinkedIn URL is only a lookup key.

You can try it with no signup: the API gives 10 free lookups a day, then monthly credit plans from $29 for 100,000 credits, billed monthly. Credits are spent only on matches. For the opposite job, finding an address for a person you chose, see [finding someone's work email](https://enrich.chat/blog/how-to-find-someones-email/), the free [email finder](https://enrich.chat/tools/email-finder/) and [whether ChatGPT can find email addresses](https://enrich.chat/blog/can-chatgpt-find-email-addresses/). The [people enrichment API](https://enrich.chat/api/person-enrichment/) page and the guide for [AI agents](https://enrich.chat/agents/) list every endpoint.

## Frequently asked questions

### Can you find out who owns an email address for free?

For a work address, partly. The domain after the @ names the company, and the company's own site or a work-email lookup can often show a role. For a personal mailbox such as Gmail, no. [ICANN's lookup tool](https://lookup.icann.org/en) covers domains, not mailboxes, and no public record maps a mailbox to its owner. Our guide to [finding a company's email address](https://enrich.chat/blog/find-company-email-address/) covers the business side.

### Can an email address be traced?

Not reliably to a person, and not from the address alone. The headers show the servers a message passed through and the SPF, DKIM and DMARC results for its domain. [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html) warns that SPF-approved mail can still carry other false identities, and [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html) separates the signer from the author. To check a sender, phone the company's official switchboard.

### How do I check the actual sender of an email?

Open the full headers and read the Authentication-Results line for spf, dkim and dmarc. In Gmail, [a question mark beside the sender's name](https://support.google.com/mail/answer/180707) means Gmail could not confirm the sender. Then compare the sender's domain with the company's official site and call its switchboard. A pass shows the domain allowed the mail, not that the domain is the company you expect.

### Can you find out who owns a Gmail address?

Not through any lawful public record. The gmail.com domain belongs to its provider, and domain registration data does not list mailbox owners. People-search sites claim otherwise, and this guide does not cover them, because identifying a private person from a mailbox can put that person at risk. If an address sends you abuse or fraud, [report it to Google](https://support.google.com/mail/answer/8253) and to the bodies listed in this guide.

### Is a WHOIS lookup useful for an email address?

Only for the domain. WHOIS and its replacement, RDAP, describe domain registrations, not mailboxes. [ICANN says RDAP replaced WHOIS](https://www.icann.org/rdap), and its [Registration Data Policy](https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy) lets registrars redact registrant name, street and phone and publish an email address or web form instead. You can still read the registrar and creation date, which help you judge a suspect domain.

### Is it legal to look up who is behind a work email?

The law follows what you do with the result. The ICO says a [name-based business address is personal data](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) even when the person acts for a business. Under [Article 14](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/when-should-we-provide-privacy-information/) you must give privacy information within one month at the latest, or at your first message. This is not legal advice.

## Sources

1. [ICANN Lookup](https://lookup.icann.org/en)
2. [RDAP overview](https://www.icann.org/rdap)
3. [Registration Data Policy](https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy)
4. [Registration Data Request Service (RDRS)](https://www.icann.org/rdrs-en)
5. [RFC 9083: JSON Responses for the Registration Data Access Protocol (RDAP)](https://www.rfc-editor.org/rfc/rfc9083.html)
6. [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html)
7. [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376.html)
8. [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html)
9. [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html)
10. [Check if your Gmail message is authenticated](https://support.google.com/mail/answer/180707)
11. [Avoid and report phishing emails](https://support.google.com/mail/answer/8253)
12. [Anti-spam message headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
13. [Phishing and suspicious behavior in Outlook](https://support.microsoft.com/en-us/outlook/mail/phishing-and-suspicious-behavior-in-outlook)
14. [How to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
15. [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/)
16. [Job scams](https://consumer.ftc.gov/articles/job-scams)
17. [Report phishing emails](https://apwg.org/reportphishing/)
18. [Report a scam email](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email)
19. [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
20. [A Longitudinal Study of Recently Observed Malicious Domains](https://arxiv.org/abs/2606.11111)
21. [Data protection explained](https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en)
22. [Business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/)
23. [When should we provide privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/when-should-we-provide-privacy-information/)
24. [Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject](https://gdpr-info.eu/art-14-gdpr/)
25. [CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)

## Try this prompt

Look up one work email, safely

```text
Use www.enrich.chat to look up the work email [work email address]. Report the name, title, company and email status exactly as returned. If it is a personal mailbox such as Gmail, stop and say it is not looked up. If nothing is found, write not found and do not guess. Then list how I can confirm the sender through the company's official site and switchboard.
```

## Related

- [How to find anyone's work email](https://enrich.chat/blog/how-to-find-someones-email/)
- [Find a company's email address](https://enrich.chat/blog/find-company-email-address/)
- [CRM data enrichment: what, how often, how](https://enrich.chat/blog/crm-data-enrichment/)