A computer implemented method for assisting email users recognizes deviations in characteristics of emails sent from a particular source identifier or “source ID” to a user. After one or more emails having a pattern of characteristics are received, an action on subsequent emails is performed, such as warning users when the subsequent emails received from the source ID match or don't match the pattern. Characteristics from a particular source ID are determined based on whether the addressee reads the email from the source ID. Various levels of warning based on the characteristics identified and the deviation of any email from the characteristics of previous emails.