A system and method for preventing email social engineering attacks, comprising a whaling/CEO fraud/imposter protection module; a vendor/supplier fraud protection module; a personal email fraud/display name abuse module; an email traffic modeling module; an auto-configure/learn mode module; an in-line protection module; an integrated malware analysis module; an email fingerprinting module; and a trust score module.