Why does my email program think that this message might be a scam?

The fundamental issue is very, very simple. Hover over this link (or click, if you like - it's safe):

http://microsoft.com

The URL it links to is not the URL that is displayed. It might be trying to deceive you into clicking on what you see to get you to go somewhere else.

In other words, it might be a scam.

This is very easy to do in HTML. More commonly, the link would be:

Buy Leo Coffee!

Which a) is not displaying a URL at all, but text, and b) is very clear about what to expect when you click.

Now let's look at something a little more sinister:

http://paypal.com

You may think you're clicking on a link to Paypal, but you're not. If the page you land on, however looks like Paypal you may not even notice.

You might get scammed.

Now, not all scams can be easily detected, and not everything that's detected is a scam. However, Thunderbird's scam detection includes something like this simple rule:

• If the display text of a link "looks like" a URL that begins with http://

• and if the target of a link is also a URL that begins with http://

• then if the rest of the URL doesn't match, it might be a scam.

The upshot is that:

http://microsoft.com

would generate the warning (display text and destination are both URLs, but they are different), while

http://buyleoalatte.com

would not - both display and destination are the same. Neither would:

microsoft.com

Since even though the display and destination are different, the displayed text is not a URL.

•

So why is it happening in a non-scam publication like my newsletter?

In fact, it's due to an extremely common and legitimate tool used in legitimate newsletters and other mass emailings: click tracking.

I'll continue to use my newsletter as an example. I occasionally include links, often from advertisers, that are complete URLs. For example: "http://www.FreePrintableCertificates.net" might be both the display text and the destination of an advertiser's link.

When the newsletter is sent, the destination of the link is automatically replaced with a different URL - something like "http://clicks.aweber.com/...". Aweber is my newsletter mailing service, and "clicks.aweber.com" is the domain they use to count clicks. When you click on the link that displays "http://www.FreePrintableCertificates.net" you're actually taken first to "http://clicks.aweber.com/..." where it simply counts the fact that you've clicked on that link, and then automatically forwards you to the intended destination, often faster than you'd ever notice.

But the display text and the destination that are encoded into the email a) are both URLs, and b) are different - so Thunderbird says "this might be a scam".

Even though it's not.

It's an extremely common technique to see just how popular things are. Understanding what people are clicking on is one of many ways that I and my advertisers get a better understanding of exactly what it is that interests people, and how better to target what we do to be more interesting and useful to you.

•

Since it's such a common technique, I personally find little value in having Thunderbird throw the warning all the time, for newsletters that I've signed up for and that I know are not scams. Unfortunately, not all email programs let you "whitelist" or say "these emails are always good" when it comes to scam detecting.

So I turn the feature off.

In Thunderbird's Tools, Options, Privacy, E-mail Scams dialog:

simply make sure that "Tell me if the message I'm reading is a suspected email scam" is unchecked.

Other email programs may have similar settings if you're seeing this warning too often.

Remember, too, that it is just a warning, not an absolute determination. With this feature enabled, which you may elect to do, it's just an alert that you need to tread carefully, nothing more.

And now you'll know what to look for.