End User Access to Emails Falsely Reported as Phishing

Users can now easily access emails that were reported as phishing but later determined to be legitimate.

When users report a suspicious email as phishing, Microsoft 365 and Google Workspace often automatically remove the message from the mailbox while the report is being analyzed or reviewed by administrators. If the reported email is later determined to be safe, users receive a notification that their report was declined, but they may no longer have convenient access to the original message.

Check Point Email Security now introduces the ability to include the original reported email as an attachment in notifications sent to end users informing them that the reported email was determined to be legitimate and not malicious. When a phishing report is reviewed and determined to be legitimate – either by Check Point’s AI analysis or by an administrator – users can immediately access the original email directly from the notification they receive.

This enhancement helps streamline user workflows and reduces frustration caused by missing emails. Instead of searching for the original message or contacting administrators for assistance, users can quickly review, respond to, or otherwise interact with the email that was mistakenly reported. The result is a smoother reporting experience that encourages users to continue reporting suspicious messages while maintaining easy access to legitimate communications.

To enable this capability, please contact Check Point Support. This option is currently not available through the management portal.

This feature is being gradually deployed and will be available for you over the next 7 days.