Patent ID: 8073916

Claim:
In a computer system that monitors electronic messages that are sent from senders to recipients, a method of determining whether an electronic message has been sent from an authorized sender, comprising: receiving an electronic message that includes information indicating the manner in which an electronic message was created, the information indicating one or more of an amount of keyboard activity or an amount of mouse activity used in creating the electronic message; determining the manner in which the electronic message should be processed according to an analysis of the information indicating the manner in which an electronic message was created; and processing the electronic message according to the analysis, the processing comprising: initiating a first challenge-response protocol when the information indicating the manner in which the electronic message was created indicates that the electronic message was generated manually; and initiating a second challenge-response protocol that is more intrusive than the first challenge-response protocol when the information indicating the manner in which the electronic message was created indicates that the electronic message was generated automatically.