Skip to content
INFIMA Knowledge Base

A user got a click reminder but says they didn't click

A user at one of your clients got our “you clicked a phishing test” reminder, and they’re telling you they never clicked. Or they spotted the email and reported it, just not with our Report Phishing button. Both have ordinary explanations, and you can check which one applies, fix the result, and keep it from happening again.

Why it happens

Section titled “Why it happens”

The report went somewhere we can’t see. A report only reaches us when the user makes it with our Report Phishing button in Outlook or our Report Phishing add-on in Gmail. Any other kind of report never reaches us, so the result can’t move to Reported:

  • Another vendor’s report button, such as Barracuda’s.
  • Outlook’s built-in Report button. Our current button takes its place on Windows, the web and Mac. With Version 2 of our button, on iPhone and Android, or on older desktop versions, Microsoft’s own option is still there, and its reports don’t reach us.
  • Gmail’s built-in Report phishing option.
  • Forwarding the email to IT, the helpdesk, or a security mailbox, or calling someone about it.

Something other than the user opened the link. Email security tools open links to check them. That includes link scanners, sandboxes, and the analysis some report tools run on a message the moment it’s reported. We screen out most of this automated traffic before a result counts as Clicked, but a tool that opens links the way a real browser does can still register a click. That’s how a user can report a test with another tool and still get a click reminder: the tool checked the link when they reported it.

A click outranks a later report. Once a click is recorded, a later report through our button doesn’t change the result. It stays Clicked until you correct it.

Check the result

Section titled “Check the result”

  1. Find the result. Open the client → Risk → Phishing, pick the user in the User filter, and click the test the reminder was about. The reminder goes out the business day after the click, so look for a Clicked or Credentials Submitted result shortly before it arrived.

  2. Read the IP Address and User Agent in the detail grid. These signs point to something other than the user:

    • The IP address belongs to a security vendor, a cloud provider, or a data center, not the client’s office network or the user’s home or mobile provider. Any IP lookup tool shows who owns an address.
    • The user agent names a browser or operating system the user doesn’t use, a years-old browser version, or a “headless” (automated) browser.
    • The Clicked At time is within a minute or two of Sent, at the moment the user says they reported the email, or in the middle of the night.
    • Several users at the client show clicks within moments of each other, all from the same IP address.

    If the IP address and user agent match the user’s own device and network, the click most likely was theirs, even if they don’t remember it.

  3. Ask how they reported it, if they say they did. The answer tells you which correction to use and what to change for next time.

Correct the result

Section titled “Correct the result”

The Mark as Reported and Reset Status buttons sit at the top right of the result page, next to the status pill. Admins with the Administrator role can use them; Training Manager and View Only admins don’t see them. Pick by what the user actually did:

What happened Use The result becomes
The user reported the test some other way Mark as Reported Reported: counts as a report, the same as one made with our button
A scanner opened the link, and the user ignored or deleted the email Reset Status Opened: no longer counts as a click
The user really did click Leave it as it is —

Deleting the email isn’t reporting it. Use Mark as Reported only when the user actually reported the test. Read phishing activity has more on both buttons.

What a correction changes

Section titled “What a correction changes”
  • A required behavior course. If the client has Make this training required on and the test was tagged with a defensive behavior, the click added a required course the business day after it happened, along with the reminder. Correcting the result withdraws that course if the user hasn’t finished it. Required training removed appears next to the buttons, the course comes off the user’s course list and the client’s Behavior Training Assignments page, and its training reminders stop. Two cases keep the course:
    • The user already completed it. Finished training is never removed.
    • Another failed test that the same course covers still stands, so the user still owes the course for that one. If that failure wasn’t theirs either, correct it too, and the course is withdrawn.
  • The reminder. If it already went out, it can’t be recalled. If you correct a Clicked or Credentials Submitted result before the reminder is sent (the business day after the click), the user gets no reminder for it, and no course is added.
  • Risk score and reports. A corrected click stops counting as a click, and a result marked Reported counts as a report. On a Credentials Submitted or Attachment Opened result, the credential submission or attachment open itself still counts in the user’s risk score and in phishing reports after a correction. Contact our support team if that event wasn’t the user’s.
  • Later clicks. A result marked Reported stays Reported if the link is opened again. A reset result can turn Clicked again if another click comes in, which is one more reason to stop the scanner (below).

Keep it from happening again

Section titled “Keep it from happening again”

Deploy our Report Phishing button. It’s the only way a report lands the user on Reported automatically, and the user sees right away that it was a test. In Outlook it replaces the built-in Report button on Windows, the web and Mac, so users report the way they’re used to, and adds a Report Phishing button on iPhone and Android. Google Workspace clients get our Gmail add-on. If the client keeps another vendor’s report button too, ask them to tell users to report with ours, which also sends real threats to the security team. Any report made with the other button will need Mark as Reported. See Report Phishing button and Report Phishing (Google Workspace).

Allow-list our phishing link domains in the client’s URL scanner. If the client’s email security scans or rewrites links, add our landing domains to its URL allow list. Scanners generally leave allow-listed links alone, which removes the most common source of clicks the user didn’t make. The domains, and the note for Mailprotector clients, are in Phishing landing pages.

You’ll know it worked when

Section titled “You’ll know it worked when”
  • The result shows Reported or Opened, with a Marked as Reported or Reset to Opened confirmation next to the buttons.
  • If the click had added a required behavior course, Required training removed appears too, and the user is no longer listed for it on the client’s Behavior Training Assignments page.
  • The test shows its corrected status in the user’s phishing history on Risk → User.
  • Once the allow list is in place, new tests at the client stop collecting clicks within moments of delivery.

Frequently asked

Section titled “Frequently asked”

The result shows Opened, but the user still got a click reminder. Did someone reset it? Yes: the click was corrected after the reminder went out, by an admin on your team or by our support team. The correction stands, and there’s nothing more to do on the result. If the click added a required behavior course and it’s still on the user’s course list, contact our support team.

I corrected the result, but the required course is still assigned. Why? Either the user already finished it, or another failed test that the same course covers still stands. Check the user’s phishing history on Risk → User for another Clicked or Credentials Submitted result on a test with the same defensive behavior. If that one wasn’t the user’s either, correct it, and the course is withdrawn.

The page says “Status saved, but removing the required training failed. Try again.” The correction itself saved, but the course is still assigned. Click the same button again to finish withdrawing it.

We have your button deployed. Why didn’t a report through Outlook’s Report button count? On iPhone and Android, and with Version 2 of our button, Microsoft’s own report option sits alongside ours rather than being replaced. A report made with Microsoft’s option goes to Microsoft, not to us. Ask users to report with ours, and use Mark as Reported for the report that was missed.

Can I correct a lot of results at once? Not from the dashboard; you correct one result at a time. If a scanner hit many users at a client on the same test, contact our support team.

Does the user hear about the correction? No. Neither button sends anything to the user. The in-the-moment “this was a test” feedback only comes from reporting with our button.

Does correcting a result change the user’s risk score? Yes, for a click. A result marked Reported counts as a report, and a reset result no longer counts as a click, so the user’s risk score and the client’s phishing numbers reflect the correction. A credential submission or attachment open on the result still counts after a correction; contact our support team if it wasn’t the user’s.

Section titled “Related”