Email: Misdirected Email Prevention

What is misdirected email prevention?

Overview
Abnormal Email Security, helps prevent sensitive information from being sent to the wrong person by mistake. When the system thinks a message may be going to the wrong recipient, it holds the message instead of delivering it and notifies you. You can then choose to send the message or cancel it. In most cases, you can clear the hold in less than a minute without contacting IT.
This protection applies to messages sent from your YSU account in Outlook, Outlook on the web, and the Outlook mobile app. It does not change how you compose or send email.

How it works
Abnormal's detection engine reviews outgoing messages for signs that a recipient may be incorrect. It uses behavioral, contextual, and content-based signals, such as who you normally email, whether a recipient's name matches a YSU employee but the address is external, and whether the subject or attachment name seems sensitive.

When a message is flagged:
1. The message is held in quarantine and is not delivered to any recipient.
2. You receive a notification from YSU IT Security Team (security-noreply@ysu.edu) with the subject line "[ACTION REQUIRED] Your email "[subject]" has been blocked".
3. The notification lists the recipient and the specific reasons the message was flagged.
4. You choose Send Anyway or Cancel Sending, then confirm your choice on a follow-up screen.
5. If you do not act within 48 hours, the message stays blocked and is never delivered.

The sample above uses placeholder names. Your notification will show your actual message and recipient.
Messages that are not flagged are delivered normally with no delay.

What triggers a hold
The system looks for a few types of mistakes. A message is more likely to be held when several signs appear together.

A message meant for a YSU colleague goes to an outside address, or a message meant for one vendor goes to a different vendor

• Recipient name matches an internal employee but the address is external;
• a recipient you rarely email;
• a sensitive subject line;
• recipients with the same display name;
• mixed or unusual domains in the recipient list

An attachment named "Vendor A Invoice" is sent to Vendor B, or a file meant for an internal recipient goes to an external one:

• jsmith@ysu.edu entered as jsmith@ysu.com
• alice@thecompany.com instead of alice@diffcompany.com

The name or address looks like a known contact at a different domain; the subject resembles past conversations with someone else

• Sending to a personal address instead of a work address (for example, john.smith@gmail.com instead of john.smith@ysu.edu) is a common trigger for both misdirected email and mis-attached file holds.

What to do when you receive a notification
Open the notification and review two things: the recipient address it names, and the reasons listed for the hold. Then choose one of the two buttons.

If the recipient is correct: Send Anyway
1. Click Send Anyway.
2. On the confirmation screen, confirm that you want to send the message to the original recipients.
3. The message is released and delivered. You receive a confirmation screen.
Releases are logged for audit purposes. Choosing Send Anyway for a legitimate message is the expected response and does not create a ticket or trigger a review.

If the recipient is wrong: Cancel Sending
1. Click Cancel Sending.
2. On the confirmation screen, confirm that you want to cancel.
3. The held message is discarded and is never delivered. You receive a confirmation screen.
4. Return to Outlook, open the message from your Sent Items, correct the recipient address, and send it again.
If you do nothing
After 48 hours, the message remains blocked and is not delivered. If you still need to send it, compose it again with the correct recipient.

Frequently asked questions (FAQ's)

Is this notification legitimate, or is it phishing?

•  Legitimate notifications will only come from security-noreply@ysu.edu. If you receive a similar message from any other address, do not click its buttons. Report it with the "Report Phishing" button in Outlook.

Will this slow down my email?

• No. Messages that are not flagged are delivered as usual. Only flagged messages are held, and you control how quickly they are released.

Why was my message flagged when the recipient was correct?

• The most common reason is emailing an external contact for the first time, especially with a subject or attachment that looks sensitive. The system learns your communication patterns over time, so repeat messages to the same contact are less likely to be flagged. Choose Send Anyway in these cases.

Does the recipient know my message was held?

• No. Recipients see nothing until the message is released. If you cancel, they never receive it.

What happens to a message I cancel?

• It is discarded and is not delivered. A copy remains in your Sent Items so you can correct the recipient and resend.

Tips to avoid misdirected email

• Check the full email address, not just the display name, before sending.
• Be careful with Outlook's auto complete. It suggests addresses you have used before, including old or personal ones.
• Add recipients last, after you have written the message and attached files.
• Open attachments before sending to confirm you selected the right file.
• Use Reply instead of Reply All unless everyone on the thread needs the message.
• When sending sensitive information outside YSU, consider whether a secure file share is a better option than email.