The click no human made

An event invitation went out with two reply links, one for yes and one for no. Each link went straight to an automation that recorded the answer. The mail platform later reported nine people who had clicked. The automation had run twenty-two times, and three contacts carried an answer without a single recorded click. For several addresses, a yes and a no had arrived within one to twelve seconds of each other. Nobody changes their mind that fast. A link scanner in the recipient's mail gateway does not have a mind to change.

Twenty-two runs for nine people

Most larger companies route incoming mail through a security gateway. Before a message reaches the inbox, the gateway follows its links to check where they lead. For the gateway this is a harmless look. For a link that records a reply, it is a click.

The invitation's links were plain web addresses with the answer built in. Opening one was enough to register it. So every scanned mail produced answers, often both of them, one after the other, in whatever order the scanner happened to follow the links. The automation had been built so that a no removed an existing yes. That meant the scanner's order decided the reply. And every reminder that carried the same links started a new wave, which could quietly erase a confirmation a real person had given days earlier.

The two systems also disagreed about the numbers. The mail platform filters obvious bot clicks out of its own report. The automation platform counts every request it receives. Both are correct about what they measure, and nobody had compared them.

Three contacts in the same second

The same client had a second automation behind its email links: a redirect that logged each click against a contact in the CRM, so that the sales team could see who was engaging. If the clicking address was unknown, it created a new contact.

A few weeks later the CRM held the same address three times, each entry marked as created from an email click. The logs showed why. Three scanner requests had arrived in the same second. All three looked for the contact, all three found nothing, all three created one. Over one week there were 84 runs, 81 of them on the path that writes data, 68 on a single day, about 25 inside eight seconds. The links being followed were exclusively in the footer: the company's social profile, a general website link. People rarely click the footer. Scanners click everything.

My test passed because I am a person

The contact-creation branch was mine, and the first version of this story is not flattering. I built the branch, suspected within minutes that most of the traffic was machine-made, and rolled it back. The next day I re-enabled it after an end-to-end test: a throwaway address, one click, contact created correctly, every field in place. The test was real and it passed.

It proved that the path worked for a human who clicks once. The traffic the branch actually received came from machines that click three times in the same second. The rollback had been the right call, and I overruled it with a test that could only ever see the case I had already imagined. The damage I had predicted arrived four weeks later.

There is a mirror image, which I mention with less certainty. In the same mail platform, a journey step that waits for a click before sending a confirmation has never registered the click in three consecutive events. Confirmations went out only after the step's seven-day timeout. The cause is not proven. The lesson for design is the same in both directions: a click is a weak signal, whether you are counting too many or too few.

What a link is allowed to change

• Links that change state should lead to a page with a button. Scanners follow links; they do not press buttons. The reply is recorded when the form is submitted, never when the page loads.
• If that is not possible yet, make the branches asymmetric. A no may never remove a yes. A yes may replace a no. The worst a scanner can then produce is a false yes, which a reminder can correct, instead of a lost confirmation, which nobody sees.
• Treat a yes and a no from the same address within a minute as no answer at all.
• Decide which links count as engagement at all. Footer links should not create contacts.
• Deduplicate where the data lands, with an update-or-create on the address. Forcing the automation to process one request at a time looks tidy, and it holds up the redirect for the real person who is waiting for the page to load.
• Compare the automation's run count with the mail platform's unique clickers after every send. When they differ by a factor of two, the difference is machines.