Valve told European Steam hardware buyers this month that a CEVA logistics breach exposed their contact details. That data is already in phishing lists. Anyone who bought a Steam Machine, a Controller, or an Index is going to see “Valve support” emails asking for account verification. This is the reality of any breach in 2026: your inbox becomes the front line.
This guide covers eight desktop apps that catch scam and phishing email before you click. All eight run on Windows, most on macOS, and several on Linux. We tested against a real phishing corpus (recent Steam, PayPal, Amazon, and Microsoft impersonation attempts) plus the Anti-Phishing Working Group test set.
What to look for in a scam email detection tool
- Real-time link scanning. The best filters check URLs against known phishing databases at click time, not just at delivery.
- Header and sender validation. SPF, DKIM, and DMARC checks catch spoofed sender addresses before content-based filters have to.
- Machine-learning content classifier. Modern phishing mimics real brands well. Statistical classifiers catch what pattern-matching misses.
- Local vs cloud processing. Cloud filters see more mail so they train better; local filters keep mail on your machine. Pick your trade-off.
- Client integration. Point solutions that require checking a separate app fail because nobody actually uses them. Prefer tools that hook into Outlook, Thunderbird, or Apple Mail.
- Warning vs deletion. Prefer tools that mark and warn rather than silent-delete; false positives happen, and losing a real email is worse than seeing a scam email.
Quick comparison
| App | Best for | Free plan | Starting price | Runs on |
|---|---|---|---|---|
| Thunderbird | Free full-featured mail client with anti-phishing | Yes | Free | Win / Mac / Linux |
| Proton Mail Bridge | Bringing Proton anti-phishing to any client | Yes (with Proton Free) | Free | Win / Mac / Linux |
| MailWasher Pro | Preview and delete on the server | Yes | Around $59.95/yr | Win / Mac |
| SpamSieve | Adaptive Bayesian filter for Apple Mail | Yes (30-day trial) | Around $39.99 one-time | Mac |
| Bitdefender Antispam | Outlook / Thunderbird plug-in | Yes with Bitdefender | Around $69.99/yr | Win |
| Malwarebytes Browser Guard | Blocks phishing URLs at click | Yes | Free | Win / Mac (extension) |
| Hornetsecurity 365 Total Protection | Business M365 protection | Trial | Contact sales | Cloud |
| SpamTitan | Small-business gateway | Trial | Contact sales | Cloud / on-prem |
The apps
1. Thunderbird, best free mail client with anti-phishing built in
Thunderbird ships with an anti-phishing engine that scans mail as it arrives, flags suspicious URLs (typo-squatted domains, mismatched display text vs actual link), and shows a warning bar at the top of any message that trips its heuristics. Its adaptive junk filter is trainable per user and gets sharper the more you use it.
Where it falls short: Phishing detection is decent but not best-in-class; it will not catch a well-crafted spear-phishing message. UI is famously utilitarian.
Pricing:
- Free, open source.
Platforms: Windows, macOS, Linux.
Download: thunderbird.net
Bottom line: The best free baseline. Install Thunderbird as your mail client and you already have functional anti-phishing.
2. Proton Mail Bridge, best for extending Proton’s protection to any client
Proton Mail Bridge exposes Proton Mail as an IMAP/SMTP server on localhost so you can use Proton with Thunderbird, Outlook, or Apple Mail while Proton’s server-side anti-phishing and encryption stay in place. Proton’s phishing detection includes header validation and known-phishing-URL blocking before mail even reaches your client.
Where it falls short: Requires a Proton Mail account (free tier works). Bridge runs as a background process and consumes some memory.
Pricing:
- Free with Proton Mail Free account.
- Proton Mail Plus around $4.99 per month for full features.
Platforms: Windows, macOS, Linux.
Download: proton.me/mail/bridge
Bottom line: The pick if you want cloud-grade anti-phishing without cloud-hosted email.
3. MailWasher Pro, best server-side preview and delete
MailWasher Pro connects to your mail server (POP3, IMAP, Gmail, Outlook.com, Hotmail) and lets you preview messages before they download. Suspicious messages get flagged, and you can bounce, blocklist, or delete on the server without ever pulling the message to your device.
Where it falls short: Windows and macOS only, no Linux build. The interface is dated. Bouncing messages (making the sender think your address is dead) does not actually deter scammers.
Pricing:
- Free version with basic filtering.
- Pro around $59.95 per year, or $99.95 one-time lifetime.
Platforms: Windows, macOS.
Download: mailwasher.net
Bottom line: The pick if you want to see a summary and delete before your mail client ever touches suspicious content.
4. SpamSieve, best adaptive Bayesian filter for Apple Mail
SpamSieve is Mac-only and integrates with Apple Mail, Outlook for Mac, Airmail, and a handful of other Mac mail clients. Its Bayesian classifier adapts to your inbox specifically; after a week of training, false positives drop close to zero.
Where it falls short: Mac only. Not a phishing-specific tool, more of a general spam filter with excellent accuracy that catches most phishing as a side effect.
Pricing:
- 30-day free trial.
- Around $39.99 one-time; free minor updates, paid major upgrades.
Platforms: macOS.
Download: c-command.com/spamsieve
Bottom line: The pick for Apple Mail users. The gold standard of Mac spam filters for over 20 years.
5. Bitdefender Antispam, best Outlook plug-in from a full security suite
Bitdefender Antispam ships as part of Bitdefender Total Security or Internet Security and plugs into Outlook and Thunderbird on Windows. It scans headers, links, and content, and shares reputation data with Bitdefender’s threat intelligence backend.
Where it falls short: Requires a full Bitdefender subscription; not sold as a standalone. Windows only.
Pricing:
- Bundled with Bitdefender Total Security, around $69.99 per year for the first year.
Platforms: Windows.
Download: bitdefender.com
Bottom line: The pick if you already run a full security suite and want anti-spam under the same license.
6. Malwarebytes Browser Guard, best browser-side click-time protection
Malwarebytes Browser Guard blocks phishing URLs at click time in Chrome, Firefox, Edge, and Safari. Since most email scams route you to a browser eventually, catching the URL after you click is the last line of defense that stops the actual credential theft.
Where it falls short: Browser extension only; does not touch the email itself. Some corporate proxies interfere with the extension.
Pricing:
- Free.
Platforms: Windows, macOS (browser extension for Chrome, Firefox, Edge, Safari).
Download: malwarebytes.com/browserguard
Bottom line: Free insurance layer. Install alongside any email filter.
7. Hornetsecurity 365 Total Protection, best for Microsoft 365 households and small businesses
Hornetsecurity 365 Total Protection is a cloud-based email security service that layers on top of Microsoft 365. It handles spam and phishing filtering, malware sandboxing, and email archive with a self-service quarantine. Even for a small household with a Microsoft 365 Family sub, it upgrades the default filter noticeably.
Where it falls short: Cloud service, not a desktop app; runs on the server side. Pricing gated behind sales contact.
Pricing:
- Trial available.
- Contact sales; typically per-user monthly.
Platforms: Cloud (integrates with Microsoft 365).
Download: hornetsecurity.com
Bottom line: The pick if you run a family or small business on Microsoft 365 and want a real security layer.
8. SpamTitan, best small-business email gateway
SpamTitan is a spam and phishing gateway service that filters mail before it reaches your server. Common in small businesses, public sector, and education. Trained anti-phishing engine, sandboxed attachment scanning, and per-user quarantine dashboard.
Where it falls short: Overkill for individual users. Setup involves changing MX records. Pricing is quote-based.
Pricing:
- Trial.
- Contact sales; typically per-user monthly or per-domain annually.
Platforms: Cloud or on-prem gateway (any mail server).
Download: spamtitan.com
Bottom line: The pick for small businesses or shared family domains that need enterprise-grade filtering.
How to pick the right one
- If you are an individual on Windows or Linux: Thunderbird as your client, Malwarebytes Browser Guard as the click-time layer.
- If you are on Mac: SpamSieve with Apple Mail, plus Malwarebytes Browser Guard.
- If you want cloud-level filtering with local mail: Proton Mail Bridge + Thunderbird.
- If you already run a security suite: use the built-in filter (Bitdefender Antispam or equivalent) rather than layering more tools.
- If you run a household on Microsoft 365: add Hornetsecurity.
- If you run a small business: SpamTitan at the gateway is the enterprise-grade pick.
- For breach-related risk after news like CEVA: enable your email provider’s suspicious login alerts, turn on 2FA for the account, and treat any “Steam Support” email as suspect until you have logged in directly through the Steam client.
FAQ
What is the best free scam email filter for Windows?
Thunderbird with its built-in anti-phishing plus Malwarebytes Browser Guard as a browser extension. Together they cover both delivery-time detection and click-time blocking, for free.
Does Gmail already filter phishing?
Yes, and it does it well. If you use Gmail through the web, most scam email is silently filtered. This guide is for people using desktop mail clients (Thunderbird, Outlook, Apple Mail) where server-side filtering does not run.
Can antivirus software detect scam emails?
Some antivirus suites include anti-spam plug-ins (Bitdefender, Norton, Kaspersky). Standalone antivirus without an anti-spam module does not touch email.
Is Proton Mail safe from phishing?
Proton runs server-side anti-phishing and blocks known phishing URLs before they reach your inbox. Combined with header validation and its own encrypted delivery, Proton is one of the harder targets for phishing.
What should I do if I already clicked a scam link?
Change the password of any account you might have entered. Enable 2FA on that account. Scan your machine with Malwarebytes or Bitdefender. If it was a work account, tell IT within the hour.
Do these apps work with Outlook?
Bitdefender Antispam plugs into Outlook on Windows. MailWasher works alongside any client. Thunderbird replaces Outlook entirely. SpamSieve works with Outlook for Mac.
