Helping people with computers... one answer at a time.

Thunderbird includes a feature that examines links in email and tries to determine if they might be a scam. Sometimes, it's just wrong.

Thunderbird thinks my newsletter is scam.

Well, it does by default, anyway.

It's actually an interesting feature in Thunderbird, but it can also be misleading or flat-out wrong.

Case in point: my newsletter is no scam.

In this video from an Ask Leo! webinar , I'll show what Thunderbird is looking for, and what it thinks is a scam.

View in HD (1280x720)

Transcript

I love your newsletter (thank you) the one thing I find annoying is that my email program, Thunderbird, always adds a warning to your email saying this message may be a scam. When I click on 'Ignore Warning,' then I can access all the links to the Ask Leo! Website. If I don't click on the 'Ignore Warning' button, it asks me to confirm my action every time I click on the link, which is annoying. Is there any way you can configure your email so Thunderbird knows they are genuine and not a scam? Or how I can configure Thunderbird to know your emails are legit?

OK. I run Thunderbird and I don't see this because I've configured it not to tell me. What Thunderbird is doing is (let's see if I can come up with a good example of this, because it's actually an interesting one for us to talk about). Let's go to the latest newsletter. So somewhere here I probably have ... here's a good example, this sponsor link. This is the web archive of the most recent newsletter. In the actual emailed version of the newsletter, what I'm about to describe actually applies to every link in the newsletter, but because this is a web archive, the same thing isn't happening. So, if I hover over the Kindle Fire link here, you can see down in the lower left corner of the browser the actual link that it goes to is go. ask-leo.com/kindlefire; in other words, it says Kindle Fire, but it's going to something that is labeled Ask Leo!. If there are any links that actually look like http links (I don't see any here), the same problem can occur. What Thunderbird is doing is it's taking a look at the links on that page and saying, "Does what this page is going to match what it says it's going to?" And if it's not, it calls that a scam. It's an interesting thing to look at in Thunderbird, but the problem is that while scammers do in fact use this, they also, this technique is also very valuable for other reasons. Obviously, when you click on Kindle Fire, you are not expecting to land on an Ask Leo! page and in fact, you don't. This happens to be a redirection that takes you to the Amazon page. This kind of redirection is very, very common in email newsletters, on websites, and so forth because what it allows me to do is, it allows me to figure out how many people bothered to click on that link. It tells me in the case of an advertisement how effective that ad is; in the case of all these other items, it tells me which articles most people are interested in; if people are ignoring an article completely, I know that it's not probably a topic I want to talk more about but if I get a lot of click-throughs on an article then I know that's something of interest.

So Thunderbird is doing its best to protect you but unfortunately the collateral damage is email newsletters. And yes, I do use my own 'search' a lot. Let's see ... so ... 'Why does my email program think that this message might be a scam?' I actually wrote an article about this some time ago that describes exactly what is happening. This is the message that you are seeing; that the person who is asking the question is seeing and in this particular case, here is a very firm example of where the link says it's going to Microsoft.com, but in fact, if you take a look at the destination down in the lower left-hand corner, you'll see that it's not going to Microsoft.com at all; it's like the classic definition of a scam link. In this particular case, it's benign but the other case is the case where somebody says, "Hey, here's a link to Paypal," but it's not. So that's what Thunderbird is trying to protect you from.

When I use the newsletter, like I said, all of the links in the newsletter get changed to be these kind of 'click-counting' redirections so that I can see what parts of my newsletter are effective and understand what people are truly interested in. Now to go back to Thunderbird, unfortunately, I had hoped that Thunderbird would allow me to turn this off on a 'per sender' basis but they do not. It's an 'all-or-nothing' kind of a thing. So, if you go into the Tools, Options, Privacy, the Email Scams tab, you can turn this option off completely so that Thunderbird doesn't check emails for this kind of scam. As I said, it's very common; you've probably seen it in other legitimate emails as well. I will leave to you as to whether this is something you want to turn on or off. The risk of turning it off of course is that you inadvertently click on a scam link and didn't realize that it was one because nobody told you. The upside of turning it off of course is that you don't have to deal with it in legitimate emails; you don't have to worry about emails from me or from other senders who are using this technique that is obviously being confused with a scam. So, I'll leave it up to you; it's a matter of how confident you are in your own ability to identify potentially scam links in email. As you might imagine, I have mine turned off completely. It's just not, to me, it's not worth the annoyance of having that thing pop up all of the time.

Article C5063 - January 31, 2012 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

3 Comments
Jane
February 3, 2012 8:52 AM

Hey, Leo, could you do us a favor and throw some paragraph breaks into your video transcripts? Have a look at how long those paragraphs are above. They're incredibly hard to read.

Thanks!

David
February 3, 2012 10:01 PM

Ironically, my mail server flagged this newsletter (with the newsletter spam topic) as possible spam, even though it has never been bothered by your past newsletters.

Edgar
June 12, 2012 8:00 AM

Quite frankly I am cheesed off with Thnderbirds "possible" scam messages. I receive many scam Emails and not one of them is seen as a possible scam by Thunderbird. On the other hand half of the newsletters I receive and open on a weekly basis are marked as possible scams.

I don't let it get to me. I just turn it off. Smile
Leo
12-Jun-2012

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.