Why security scanners inflate your email click rate

Many company mail systems click every link in an incoming email to check it for danger, often within seconds of delivery. Counted as clicks, those scans make a list look far more interested than it is. Email Digit records a click that looks automated but keeps it out of your click count and the contact’s engagement score, and shows the filtered clicks in the campaign export so you can check the filter yourself.

Why a scanner clicks your links

Email security gateways protect a company’s staff from phishing by fetching the links in incoming mail and checking where they lead. Some do it when the message arrives, some when it is opened, and some rewrite links so every click passes through a check first. Separately, chat and collaboration apps fetch a link to build a preview when someone pastes it.

From the sending side, every one of those fetches looks like a person clicking. Your tracking link is requested, the redirect fires, and a click is recorded against the contact, often within a few seconds of the email being sent.

This is not the reader’s security team misbehaving. Scanning links is a sensible defence, and the mail still reaches the person. The only problem is on the measuring side, when a tool cannot tell the scan from the reader.

Signs that your click numbers include scanners

• Clicks arriving seconds after the send, before a person could plausibly have read anything.
• Every link in the same email clicked by the same contact at once, including the footer.
• Unusually high click rates on lists of work addresses, compared with personal addresses.
• Contacts who “click” every campaign and never reply, buy or visit a second page.

None of these is proof on its own; a keen reader can click fast, and some people do open every link. Together, and across many campaigns, they are a strong hint. If your business-to-business click rates look suspiciously high, scanners are one likely reason.

What scanner clicks break

An inflated click rate is the visible problem. The quieter one is everything built on top of clicks. A contact behind a scanning gateway can be scored as highly engaged, land in your “most engaged” segment, stay off your list of people to stop emailing, and trigger an automation meant for interested readers, all without a person ever seeing the email. That is the same failure open rates have, arriving through a different door.

How Email Digit tells them apart

No single signal identifies a scanner reliably, so Email Digit combines several and marks a click as machine when any one fires clearly:

The timing signal never works alone against a recognised browser: a real browser clicking eight seconds after the send is treated as an eager human.

A machine click is recorded, because it happened and is useful when you investigate a deliverability question. It is not counted. It does not add to the campaign’s click count, the contact’s clicks, their last engagement date or their engagement score, so it cannot move them into a segment, keep them off the list of contacts to stop emailing, or trigger an automation. No click webhook is sent for it either. Opens get the same treatment for the same reason: they are shown and never scored.

Check the filter yourself

Nothing is hidden. The campaign CSV export has one row per recipient, with the filtered machine clicks in their own column next to the real ones:

email,contact_name,status,stream,ab_variant,sent_at,first_opened_at,
first_clicked_at,click_count,machine_click_count,error,
campaign_name,campaign_subject,campaign_status

The export is streamed from the server, so a large campaign comes out complete rather than as the rows the page happened to have loaded. A few ways to use it:

1. Sort by machine_click_count to see which recipients’ mail is being scanned.
2. Group by the domain of the address to find the companies running gateways.
3. Compare click_count with the visits your web analytics recorded on the landing page for the same campaign.

Limits

• It is a heuristic. Some scanners imitate browsers closely, and a click from one of those can still be counted.
• It leans toward “machine”. A very fast human click from an unusual client can be discounted. That is a deliberate choice: wrongly discounting one real click costs a contact a few points that later activity recovers, while counting a scanner’s click corrupts segments and automations without anyone noticing.
• Clicks are still the weakest signal. Even a real click counts for less than a reply or a purchase in the engagement score.

It is safer to under-count interest than to report a scanner’s as yours. For the score these clicks are kept out of, read how engagement is scored, or see Email Digit for marketers.