Are Bots Affecting Your Email?

[#1]

Hi, HubSpot Community. I’m Jake from the HubSpot Product team. In the last year, the marketing industry as a whole has seen a spike in bot clicks in emails, so I wanted to take a moment to discuss what bot activity looks like, who’s most likely to be affected, and what you can do to address it.

What’s bot activity?

Bots are the source of a lot of internet traffic today. It’s estimated that more than half of web traffic originates from a bot, and bots are more sophisticated today than even a few years ago. Not all bots are bad bots, though! Google’s search engine bots, for example, crawl websites and index them; HubSpot’s chatbots help to facilitate conversations with your prospects and customers without requiring a human. 

Unfortunately, there are also bots that create fake clicks and false impressions for apps, websites, and emails. With email, bots are designed to click links in emails as a way to explore, identify, and prevent links to malware or phishing attacks from entering a recipient's inbox.

Okay, so what does bot activity in emails look like?

Email bot activity differs from what bot activity may look like on a website. Bot activity in email is typically security software sitting in front of a recipient’s (or contact’s) inbox. That security software will open the email and, typically, engage with some (if not all) of the corresponding links in that email, following them through the redirect. These actions simulate real user engagement potentially causing false opens and clicks data to be recorded.

Every email marketer who has sent an email campaign has probably been affected by bots. And bots are tricky for email marketers because the email engagement events (opens and clicks) they generate can get recorded alongside legitimate ones. This leads to email campaign statistic inflation as well as automation being tripped based on these false events.

Who’s more likely to be impacted? 

Bots don’t impact all marketers equally. These security filters are much more common in industries tied to finance or healthcare but aren’t as common in B2C marketing. Generally, regulated industries where contacts use a company email see more bot clicks than personal email addresses on email providers like Gmail or Office365.

So, what can we do about it?

For HubSpot, identifying bots and separating them from legitimate contact engagement has been, frankly, a game of Whac-a-Mole. In the last year, the industry as a whole has seen a spike in phishing emails. This rise in phishing has led to corresponding increases in companies adding security software (i.e., more bot activity). 

At HubSpot, we’re doing our best to address this rise. Currently, we’re working on redesigns to email reporting to better separate legitimate contact email engagement from that generated by security software. The entire team at HubSpot, including myself, recognizes this can cause anxiety for a marketer. We will continue to do everything we can to find a solution that best addresses this problem. Until we have a full solution, we’ll be monitoring this thread to answer any relevant questions or concerns and respond to any feedback you have about this.

[#2]

Very interesting. Our company has noticed strange email open/click behavior in the past. Most notably, we had some unusual spikes in direct traffic from recipients only clicking the first link in every email we sent (the link happened to be from our company logo and led to our website's home page, which may have caused it to trigger as Direct?)

Essentially, we were seeing dozens of clicks from each email but with absolutely no engagement otherwise. It was really bizarre, and it did seem like some strange bot activity. Even this year, sometimes our emails consistently get the same number of clicks from the same people (give or take 20-23 clicks), while other emails receive nothing at all. Strange...

[#3]

Thank you for sharing. A lot of that does sound like bot activity. Two common patterns are: 

1. Opens or Clicks almost immediately after the email was delivered. You can see this by clicking into the 'Recipients' tab on the individual emails. Then expanding the contact's timeline of events. If the timestamp for the delivered and the open or click are very close together (less than a minute or two). That is a strong indication it is a bot. 
2. If every single link in the email is clicked. That is another strong indication it is a bot. We will see the same emails delivered to the same domain, and all come out with exactly 15 clicks. Again most likely a bot. 

[#4]

Another way we noticed the large scale extent of this problem (we sell into very large enterprises who probably have extensive security protections) is when the number of clicks at a company equals the number of opens.  We try to aggregate engagement at the company-level and found most companies had that occurring. 

[#5]

Yes! Absolutely...looking at patterns across like recipient domains is definitely another way to identify companies using security software on their email inboxes. 

[#6]

Oh wow, this totally lines up with what we've been seeing! Most notably, a contact clicks a link multiple times as well, and it's almost always as soon as the email is delivered to them. Is there anything we can do to avoid this or prevent it from continuing? Last month it completely skewed our metrics since we had way more Email traffic than we normally would. Now, we seem to be having a lot less. 

[#7]

Hi @Phil_DM2 - Thanks for sharing. That is unfortunate that it skewed your metrics the previous month. We have been doing some interim work to identify some of the worst offenders and make sure those open & clicks aren't recorded. This may be why you are seeing less now. 

In terms of what you can do - nothing at the moment. We are in the midst of rolling out a new solution for bots on email. So you should continue to see your metrics get more and more accurate over the coming months.

[#8]

Hi @jaleonard19 ,

When you say you're identifying the worst offenders and making sure their engagement isn't recorded, does that mean we won't get any engagement metrics at all from certain accounts? If so, I think that's a bit heavy handed. 

Also, there's another obvious sign of a bot that hasn't been mentioned here: when a contact registers as both a click and a hard bounce. If illusory engagement like that could be filtered out of the metrics, rather than entire accounts, that'd be the most balanced solution IMO. 

When the new solution rolls out, will there be a report of what filters have been implemented? Would be good to know when this happens so we can start using email engagement data for lead scoring and other purposes.

[#9]

Hi @DanFromCF - 

Certainly not, we are not blocking individual email accounts, domains or anything that would prevent you from seeing legitimate engagement metrics. We use other signals on the open and click events that we capture to separate and block the bots (IP, UserAgent, etc.). 

The new solution will actually be based more on behaviors. For example, if we see an email opened and then a click on every single link on the email within a short time window then that is a good indication that it is a bot.  Another could be opens of the same email, at the exact same time across similar domains.

I hope that clarifies some of your concerns! Let me know if you have any more questions.  

[#10]

Thanks for posting this. I notice that in my emails, 14% clicked on the logo which kind of makes no sense. If there is a beta or something, I would be interested!

[#11]

Hi @mrspabs - eeeekkkk. Yea that doesn't sound right, sorry you are running into that. Unfortunately, we are not doing any formal Beta, rather we are doing a generalized slow-roll out of the solution. 

[#12]

This was also posted to the ideas forum.

One thing we've been doing and it's partially working (i.e. - need to send more email and this solution will never be a 100% answer as spam systems are always changing the way they work and no two are exactly alike), but add an invisible link to a page on your site in your emails.  For example, in the below screenshot, "Communication" had a link to an old blog about "Communication", but it looks like all the rest of the text so unless you got lucky and moused over it, you'd never know it was a link.  Then we segmented the people (aka bots) that were sent the email and clicked on the link and sure enough, by looking at the details of the clicks it's very clear it's a bot clicking (screenshot below - this is a monthly newsletter so has a ton of links in it).  The next step which is still a work in progress is to add a specific list of domains that have suspicious / bot clicks and then segment these out of any automated follow up that is based on activity.  One thing to mention is that some bots / spam systems will not click on every link in an email, but by doing this on every email you send, you can start to identify / weed out the domains that have aggressive spam systems in place that adversely affect reporting and other automated tasks.  You can also segment your sends so that one email goes to suspicious domains and the other goes to people that don't have the suspicious activity.  Then you can manually review the suspicious activity to determine next steps.  Not a perfect solution and I'll share more on some things we're working on.

[#13]

Thanks for sharing @Mike_Donnelly! Very interesting solution, basically a captcha like solution for email. Mind sharing the ideas forum post here? 

[#14]

Hey @jaleonard19 - Thanks and the above was everything I posted in the ideas forum.  We're working on a few other ideas which will flag domains, but it's still a work in progress.  Essentially, if you bubble up the top domains clicking a lot of links, you can be extremely confident they're coming from bots / spam systems.  Then you can further investigate by looking at the timeline.  Much of what you've specified is what we've been working on.  Not a perfect solution (as it never will be), but it removes a lot of noise.

[#15]

we are receiving "clicks" even without the recipient clicking the link at all. There is no distinction between opens and clicks , this has happened after applying secure mail gateway, we have opened a ticket and it was transfered to you if you have reached for a workaround/solution of the issue yet, your quick response is highly appreciated.

[#16]

Yes, they are . Can you please resolve this issue as we cannot distinguish between  "clicks"  and  "opens"  .  This inability from Hubspot to  fix  this  is having a direct impact on  my ability to perform my job.  I am  imploring you to  please  give this a priority

much appreciated