I have had that happen before with Proton and wondered to myself: How are they assessing this? Whether they were right or not, it required a lot of analysis that in theory wasn't supposed to happen. I'm not saying anti-fraud systems are inherently bad, but how can you have an anti-fraud detection system in a privacy email service without reading emails or using javascript to try to measure a user's machine information?