Picture this: your latest database reactivation campaign goes out to 4,000 dormant candidates. The dashboard lights up - a 38% open rate, a 12% click rate. By any normal standard, that's a campaign worth celebrating. Your consultants pull the "engaged" list and start dialling.
Three hours later, almost nobody picks up. The handful who do have no idea what email you're talking about.
This isn't a fluke. It's one of the most common - and least discussed - problems in recruitment marketing right now: a meaningful share of the opens and clicks showing up in your reporting aren't coming from candidates or clients at all.
Key findings
- Corporate security gateways and Apple's Mail Privacy Protection routinely pre-click and pre-load every link and pixel in an inbound email, regardless of whether a human opens it.
- Bot-inflated engagement corrupts reactivation prioritisation, lead scoring, and client reporting - all three rely on the same flawed signal.
- Reliable tells include clicks landing in 1-3 seconds of send, activity from datacentre IP ranges, and zero follow-up page activity.
- Agencies that filter bot activity often find their "engaged" segment shrinks by a third or more - but converts at a noticeably higher rate.
What's Actually Happening
Most of this isn't malicious, it's infrastructure. Corporate email security gateways (Microsoft Defender, Proofpoint, Mimecast) routinely "pre-click" every link in an inbound email to scan it for threats before the message ever reaches the inbox. Apple's Mail Privacy Protection pre-loads tracking pixels for every Apple Mail user regardless of whether they ever open the message. Some VPNs and antivirus tools do the same.
None of this is a candidate engaging with your content. It's software checking a box. But to a marketing automation platform that just counts pixel loads and link clicks, it looks identical to a genuinely interested person.
Why This Matters More in Recruitment Than Almost Anywhere Else
In most B2B marketing, inflated engagement is an annoyance. In recruitment marketing, it directly corrupts three things you rely on every day:
Database reactivation prioritisation. If "most engaged" candidates are actually just the ones whose IT department scans links most aggressively, your consultants are calling the wrong people first - and the genuinely warm candidates further down the list go cold while they wait. See our piece on database reactivation in a tighter talent market for how this connects.
Lead and candidate scoring. Any scoring model that weights opens and clicks is quietly rewarding security software, not interest. Over time, your "hot" segment drifts further from reality.
Client reporting. If you're reporting campaign performance to a client as proof of value, bot-inflated numbers eventually get exposed - usually when a client asks "why didn't any of these engaged candidates apply?"
How to Spot It
A few patterns are reliable tells:
- A click that lands within 1-3 seconds of the send time, before a human could plausibly have opened and read the email
- Opens or clicks originating from known datacentre or cloud-hosting IP ranges rather than residential or mobile networks
- A click with zero corresponding page activity afterwards (no scroll, no time on page, no follow-up action)
- The same link "clicked" by a large proportion of a list within the same narrow time window, regardless of send time stagger
Spotted individually, none of these proves anything. Spotted together, across thousands of sends, the pattern becomes very hard to ignore.
What Good Data Discipline Looks Like
The fix isn't to stop tracking engagement - it's to filter before you trust. That means:
- Running every open and click through a filtering layer that flags known bot, scanner, and pre-fetch signatures before they ever reach your scoring or segmentation logic
- Keeping a separate "verified engagement" metric distinct from raw opens/clicks, and basing call lists and reactivation priority on the former
- Re-checking your historic baselines once filtering is in place - many agencies discover their "engaged" segment shrinks by a third or more, but converts at a noticeably higher rate
This is one of the reasons we built bot-click filtering directly into the Kulea platform rather than treating it as a reporting afterthought. When a candidate or client contact shows as engaged, you can actually trust it - and your consultants can spend their time calling people who are real.
If you want to see what your current engagement data looks like once bot and scanner activity is filtered out, book a demo and we'll show you the difference on your own numbers.
Frequently Asked Questions
Why do email opens and clicks sometimes come from bots, not people?
Corporate email security gateways routinely pre-click every link in an inbound email to scan it for threats before it reaches the inbox, and Apple's Mail Privacy Protection pre-loads tracking pixels for every Apple Mail user regardless of whether they open the message. To a platform that just counts pixel loads and link clicks, this looks identical to genuine engagement.
How can you tell if an open or click is from a bot rather than a real person?
Reliable tells include a click landing within 1-3 seconds of send (before a human could plausibly have read the email), activity from known datacentre or cloud-hosting IP ranges rather than residential or mobile networks, a click with no corresponding page activity afterwards, and the same link being clicked by a large share of a list within the same narrow time window regardless of send stagger.
Andrew Nicholson
Co-founder & CEO at Kulea. Guest lecturer in digital psychology and behavioural economics at the University of Buckingham.