Why "Are You Sure?" Email Pop-Ups Stop Working, and How to Fix It

The pop-up everyone clicks through

A company has an email go to the wrong client. Someone adds a confirmation: every time an email goes outside the company, a box lists the recipients and asks you to confirm.

For the first week, people read it. By the third week, it is part of sending: click Send, click Confirm, without reading. The day it finally matters, it gets the same click as the two hundred before it.

This is not a people problem. It is how attention works. A warning that fires on almost everything stops carrying any information, so the brain stops spending effort on it. Security researchers call it habituation, and it is well documented for browser warnings, permission prompts and SSL errors. Email confirmations are no different.

What makes a warning get read

A warning works when it is rare and specific. Rare, because then it is surprising, and surprise gets attention. Specific, because "This email includes external recipients" tells you nothing new, while "This email goes to jane@oldvendor.com" makes you look at the address.

So the goal is not more warnings. It is fewer, better ones.

Five ways to keep a send-time warning useful

1. Show the addresses, not a count

"2 external recipients" asks you to trust that you know who they are. Listing the actual addresses asks you to look. One line per address, outside ones first, nothing else on screen.

2. Don't stop the emails that are obviously fine

If half your outside email goes to the same three client domains, a stop on those teaches people to click through. Let those through with a quiet note next to the draft, and save the stop for the rest. A note people can glance at is worth more than a stop people have learned to skip.

3. Stop on what is inside the email, too

The worst wrong-recipient emails are the ones with something sensitive in them. A card number, a password, a salary figure or a client's name going to someone outside is a stronger reason to stop than an outside address alone. Warnings that fire on the combination are rare, and they are almost always worth reading.

4. Ask again when something changes

If someone clicks "Send anyway", then adds a new person to Cc, the confirmation they gave no longer covers the email. Ask again. Most wrong-recipient mistakes happen right at the end: a Cc added while finishing the reply, a forward to "just one more person".

5. Let people tune it

The person who sends forty client emails a day needs a different setting from the person who sends two. If the only choices are "on for everyone" or "off", people will lobby for off.

How we built Presend around this

Presend checks every email when you click Send, in Gmail, Outlook on the web and other places you write. Each check has four levels: Block, Warn, Note and Off.

• The External recipients check is set to Note by default. Outside addresses are listed next to your draft, and Send is not interrupted.
• Teams that want a SafeSend-style stop set it to Block. Send then shows "Hold on" with the outside addresses, and asks again if the recipients change after you confirmed.
• Checks for what is inside the email, like a leaked API key or a card number, block by default, because those are rare and nearly always worth a second look.
• You can write your own rules in plain English for the exact combination that worries you, such as "Block any email to an outside address that mentions Project Falcon."

If you are choosing between a stop on every outside email and something lighter, we compared the approaches in our SafeSend alternative page. The right answer depends on your company. The wrong answer is a pop-up nobody reads.