Fake clicks in cold email are link clicks logged by software instead of by your prospect. Many come from the security system that guards the recipient's inbox. It requests the links in incoming mail to check them for phishing, and your sending tool can record that check as a click. The fix is to stop reading clicks as interest and judge the campaign by replies.
Email platforms admit this in their own help pages. Constant Contact's knowledge base says security filter inspections "will often cause an open and/or a click to be recorded." Its filter is a list of known non-human user agents, the labels software sends to identify itself when it loads a page. When one of those agents scans a link in your email, the click is not recorded.
So a campaign can show a busy click rate and almost no replies, and both numbers can be accurate. Only one of them counts people - the replies.
Why do cold emails show clicks but no replies?
A click and a reader are separate events. A filter can request your link seconds after delivery, before anyone at the company has seen the subject line. The dashboard logs activity while the email still sits unread.
Strip out the machine clicks and the ones left are few, and each only says that someone loaded a page. That is a weak signal. It tells you nothing about whether that person wants a meeting.
Opens suffer from the same flaw, which is why open rate is the wrong number to manage. In both cases a tool counts an event and the seller supplies the intent.
I judge a campaign by what people write back. A click appears nowhere on the path from reply to client.
One "buy or die" message is a lottery ticket. A click goal is an even weaker target, because it counts the ticket as a win when nobody answers. Even a goal of 10 booked sales calls is too narrow. Aim to start 50+ conversations this month and let the meetings come out of those.
What do Safe Links and link protection do to your URL?
Two widely used security products show how it works.
Microsoft Safe Links, part of Defender for Office 365, scans and rewrites the URLs in inbound email while the message is in transit. The documentation says scanned URLs get wrapped in a prefix such as nam01.safelinks.protection.outlook.com, so your link turns into a Microsoft address. The same page says a rewritten link is scanned for malicious content again when the user clicks it, before they reach the page.
Barracuda Link Protection works on the same principle. It rewrites URLs and analyzes the URL and domain in real time. When the link looks bad, the user lands on a warning page instead of the site.
These products do exactly what their buyers pay for, which is stopping phishing. Your reporting absorbs the side effect, and gateways such as Mimecast and Proofpoint can also reject, quarantine or rewrite cold emails for different reasons.
Cold email tools count clicks through a tracking link. To your tool, any software that requests that link to check where it leads looks exactly like a buyer who clicked. Filters for known scanner user agents, like Constant Contact's, catch some of these requests. Anything outside that list still looks like a person to your tool.
How do you tell bot clicks from real clicks?
A useful public checklist comes from phishing simulation, where companies send fake phishing emails to their own staff and need to know who really clicked. KnowBe4 calls clicks that were not caused by a user clicking the link "false positives".
To spot them, KnowBe4 points to delivered, open and click times that are identical or within a minute of each other, a 100 percent click rate, and IP addresses that do not belong to the organization.
Translated to a sales campaign, the signals look like this:
| Signal | Points to a machine | Points to a person |
|---|---|---|
| Timing | Delivered, opened and clicked in the same minute | A gap of minutes or hours between delivery and the click |
| Source of the request | An IP owned by a security vendor, a cloud host or a scanning service | A mobile carrier, a home connection or public Wi-Fi: likely human, though not proof |
| Spread inside one company | Several contacts at the same domain clicking within seconds of each other | One contact clicking on their own schedule |
| Click rate on a segment | Every contact in the segment, or nearly all | A small share that moves when you change the list or the copy |
| What happens next | Nothing: no reply, no booking, no return visit | A reply, a question or a meeting request |
A gateway that protects a company checks the mail of everyone there. That is why scanner clicks can arrive in bunches by domain.
One row on its own proves little. When three or four rows point the same way, you can usually call it.
What should you count instead of click rate?
Count replies, then count how many of them turn into meetings.
In the campaigns my team runs, roughly 1 cold email in 100 gets a reply. When a sender pushes thousands of emails a day, 0.5% is more typical. Somewhere between a tenth and a half of replies become booked meetings, and all of these averages slide down as volume goes up. Reply rate benchmarks for cold email break the ranges down further.
Sort replies into positive, neutral and "no", then track how many positive replies become meetings in each channel. With that, you can compare channels, plan next month's volume and argue about copy using numbers that describe people. A click column adds noise to every one of those decisions.
Conversations come first. Calls come out of conversations. Clients come out of calls. So the weekly report counts conversations started, not clicks.
What a founder should watch from week to week is simple: are replies moving, and are the positive ones turning into meetings?
How do fake clicks lead to bad follow-ups?
Automation is where the damage happens. Plenty of sequences branch on clicks, and the classic trap is the "saw you checked out our page" email.
When a scanner made the click, a prospect who never read your first email gets a message assuming they did. It reads as odd, or as surveillance, and the follow-up is burned.
Follow-ups are too valuable for that. In our campaigns the third one, sent with real time after the second, is usually the message that gets the reply, which is why the number of follow-ups in a sequence matters.
The second mistake is strategic. A team watches clicks pile up, decides interest is high and makes the next message pushier: a bigger ask, a pricing link, a request for a decision. A campaign heavy on clicks and light on replies calls for the opposite, because nothing in it shows that anyone is ready.
Pushing harder also misses where buyers decide. They look you up online before they reply. A so-so message from a sender with a credible profile will beat a polished message from someone buyers cannot find. Same copy, two different senders: one company got a 2% reply rate, the other got 7.5%.
Buyers audit you before they buy, and a scanner never does. A real prospect does, then answers with a reply or with silence.
So let what people write drive the next step. Only a person can write a reply, while a click can come from a firewall. If you keep a click branch at all, let it fire only on clicks that pass the timing and domain checks.
How do you audit your click data in a spreadsheet?
You can do this with a plain export from your sending tool.
- Export two to four weeks of events with the delivery, open and click timestamp for every contact.
- Mark each click that arrived within a minute of delivery.
- Sort the remaining clicks by recipient domain and mark companies where several contacts clicked seconds apart.
- If your tool shows the IP or its owner, mark security vendors, cloud hosts and scanning services.
- Check the unmarked clicks against your reply log and note which of those contacts ever wrote back.
- Recalculate the click rate without the marked events and put it beside your reply rate.
The decision rule: when a click came within a minute of delivery, from an address you cannot tie to a person, and never led to a reply, treat it as scanner noise until something proves otherwise. Do not follow up on it, and keep it out of any count of interested leads.
A made-up week shows the arithmetic. You send 2,000 first emails and the dashboard shows 140 clicks, a 7% click rate. The audit marks 110 of them as same-minute or same-domain clusters, leaving 30 that might be people.
In that same week 18 contacts replied, 0.9% and close to the normal range above. 4 of the replies are positive, and 2 become booked meetings.
If a click branch fired in a week like this, 110 people got an email written for someone who had read the first one. The figures that should decide next week, 18 replies and 2 meetings, sat in the report the whole time.
When should you change the message instead of the metric?
After the audit you are left with replies, and replies flatter nobody. If they are low, check in this order, because strong copy cannot rescue a weak list or a sender buyers do not trust.
- The list. Wrong titles and unverified addresses sink a campaign before anyone reads it. Verify every address so your bounce rate stays under 0.5%.
- The sender. A cold email setup usually spreads sending over 10 to 20 domains with 20 to 40 mailboxes, and bigger senders need more. Each domain gets SPF, DKIM and DMARC before it sends anything, and each new mailbox warms up for 10 to 14 days at minimum. Details are in our deliverability and infrastructure FAQ.
- The message. Rewriting copy only tells you something once the list and the sender hold up.
Leave the clicks alone while you work through this. Adding more links for people to click, or sending more to grow the click number, only makes the noise louder. More volume multiplies whatever a campaign already does, and that includes failing.
Count what people write back. Scanners click, but they never reply.
If your click numbers and reply numbers disagree and you are unsure which to trust, send me an export and I will tell you what I see. Book a call.
Questions founders ask about fake clicks
Should I turn off click tracking in cold email?
If nobody on your team acts on clicks, switching tracking off costs you very little and removes a tracking redirect from every message you send. If you keep it, use the click column for diagnosis only, never as a trigger or a headline number. A simpler option is a first email with no link at all, since the only ask is a reply.
Can a real prospect click after a scanner already did?
Yes. A scanner click does not use up the link, so the same contact can show a machine click at delivery and a human click hours later. Judge each click by its own timing and source, never by the first one in the log. If a reply follows the later click, that reply is the signal to act on.
Does a custom tracking domain stop fake clicks?
Not by itself. A custom tracking domain changes the address your tracking link runs through, but a gateway that checks links can still request it to see where it leads. The scanner click simply gets logged under your own domain instead of the tool's shared one. Keep running the timing and domain checks on every export, whichever setup you use.
Why can phishing-test teams remove bot clicks when cold emailers cannot?
They own the filter. KnowBe4 says improper whitelisting of a spam filter can cause automated or bot clicks, so a company testing its own staff can fix the cause inside its own gateway settings. A cold emailer has no say over a prospect's security setup, so those clicks will keep arriving and have to be filtered in your reports.