How to Report False Positives and Request Trusted Sender Review

Applies to: Microsoft 365, Outlook, Google Workspace, Gmail, and Organizations Protected by TSN Cyber Email Security
Difficulty: Beginner
Estimated Time: 5–10 minutes

Overview

TSN Cyber Email Security uses Trustifi technology to help protect your organization from phishing, spam, malicious attachments, impersonation, and other email threats.

Sometimes a legitimate email may be incorrectly identified as suspicious or unsafe. This is called a false positive.

For example, an email from a trusted vendor may receive a warning or be quarantined even though it contains legitimate business information.

You can report potential false positives so they can be reviewed and, when appropriate, corrected.

This guide explains how to identify false positives, report incorrectly classified messages, request a trusted sender review, and address recurring email filtering problems.

Before You Begin:

Have access to your work email account.
Know the sender’s complete email address.
Have the message subject and approximate delivery time available.
Confirm that you were expecting the message.
Use your organization’s approved email reporting or support process.

Important: A message is not necessarily safe just because it appears to come from someone you know. Legitimate accounts can be compromised, and sender addresses can be impersonated.

Understanding False Positives

A false positive occurs when an email security system incorrectly identifies a legitimate message as a threat or unwanted communication.

For example:

A valid invoice is categorized as spam.
A trusted vendor’s message is quarantined.
A legitimate newsletter is incorrectly flagged.
A coworker’s expected message receives a suspicious-email warning.
A business document is blocked because of its content or attachment characteristics.

Email security systems evaluate many signals to help identify threats.

Because these systems prioritize protecting users, legitimate messages may occasionally be misclassified.

Important: Do not assume that every warning is a false positive. Investigate suspicious content before requesting changes.

Understanding TSN Cyber Email Classifications

Depending on the security configuration, Trustifi may classify messages into several categories.

Classification	General Meaning
Safe	No significant threat was identified under the applicable analysis
External	Message originated outside the organization
Graymail	Bulk or promotional email that may be legitimate
Spam	Unwanted or unsolicited communication
Suspicious	Message contains characteristics associated with possible threats
Malicious	Message has been identified as containing or representing a significant threat

Note: A classification is a security assessment, not an absolute guarantee.

For example, a message marked Safe may still contain a fraudulent business request that requires independent verification.

Step 1: Confirm That the Message Is Legitimate

Before reporting a false positive, verify that the message was expected.

Review the Sender

Open the email if it was delivered to your Inbox.
Do not click links or open attachments.
Review the sender’s complete email address.
Compare it with verified contact information.
Check for unusual spelling or domains.

Review the Request

Ask yourself:

Was I expecting this email?
Do I recognize the sender?
Is the subject consistent with our normal business relationship?
Does the message request an unusual payment or account change?
Does it contain an unexpected attachment?
Does it ask for passwords or verification codes?

Important: If the sender asks you to change banking information, approve an unexpected login, or provide sensitive credentials, verify the request through a trusted independent channel.

Step 2: Review the Security Warning

If TSN Cyber Email Security places a warning on a delivered message:

Open the email without interacting with its links or attachments.
Read the security warning.
Identify the stated concern.
Determine whether the message is expected.
Contact the sender independently if necessary.

Depending on your organization’s configuration, warning labels may include controls such as:

Report Email
Trust Email

Important: These controls may not be available for every message or organization.

Microsoft Outlook — Report an Incorrect Classification

If your organization uses the Trustifi Outlook add-in, you may be able to report an incorrectly classified email directly.

Step 1: Open Outlook

Open your approved Outlook application.
Sign in to your work account.
Locate the email you believe was incorrectly classified.

Step 2: Open Trustifi

Select the message.
Open the Trustifi add-in.
Allow the security analysis to finish.
Review the displayed classification.

Step 3: Report the Email as Safe

If the message is incorrectly classified and you have verified it:

Select I trust this email, if available.
Review the displayed reporting options.
Keep Report to Trustifi selected when available.
Review any additional trust or allowlist options carefully.
Confirm the report.

Important: Trustifi may also offer options such as Trust Sender, Trust Links, or Trust Attachments. These can affect future security treatment.

Do not enable these additional options unless you understand their effect and are authorized to do so. If uncertain, contact True Synergy Networks.

Note: Reporting a false positive helps Trustifi evaluate its detection accuracy but does not guarantee that the sender will be globally trusted.

Gmail — Report an Incorrect Classification

If your Google Workspace account uses the Trustifi Gmail integration:

Step 1: Open Gmail

Sign in to Gmail using your work account.
Locate the affected email.
Open the message.

Step 2: Open Trustifi

Locate the Trustifi add-in or extension.
Allow the email analysis to complete.
Review the classification.

Step 3: Report the Message

Select I trust this email, if available.
Review the reporting options.
Keep Report to Trustifi selected when appropriate.
Avoid adding links or attachments to trusted lists unless specifically approved.
Confirm the action.

Note: The available controls depend on your organization’s Trustifi configuration and browser integration.

If reporting is unavailable, contact True Synergy Networks.

How to Report a False Positive from an Email Warning Banner

Some TSN Cyber-protected emails may include a security banner.

Depending on your organization’s settings, the banner may provide a direct reporting option.

Step 1: Review the Banner

Open the email.
Locate the displayed security warning.
Review the message classification.
Verify the sender and context independently.

Step 2: Select the Reporting Option

If your organization has enabled it:

Click Trust Email.
Review the secure confirmation page.
Complete any required verification.
Confirm the action.

Important: Trustifi’s Trust Email action can add the sender to your personal allowlist. Do not use it merely to dismiss a warning.

If you only want the message reviewed, contact True Synergy Networks and request a false-positive assessment instead.

Note: Some organizations disable reporting directly from warning banners.

How to Report a Quarantined Email

If a legitimate email is held in quarantine, you may not be able to open it in your normal Inbox.

Step 1: Check the Quarantine Notification

Open your email application.
Look for a legitimate security notification.
Review the sender, subject, and time.
Confirm that you were expecting the message.

Step 2: Request Review

If your organization provides a release request control:

Select the correct message.
Choose Request Release, if available.
Submit the request.
Wait for the authorized review.

If the option is unavailable:

Contact True Synergy Networks.
Provide the sender and recipient addresses.
Include the approximate sending date and time.
Explain why you believe the message is legitimate.

Important: Regular users generally cannot release quarantined messages by default. Release permissions depend on your organization’s policies.

Do not attempt to bypass quarantine restrictions.

What Information Should I Provide for a False-Positive Review?

When contacting True Synergy Networks, include:

Your company name.
Your recipient email address.
The sender’s complete email address.
The subject line.
The approximate date and time.
Whether the message was quarantined or delivered with a warning.
Any available security classification.
Whether this has happened before.
Why you believe the sender and message are legitimate.

Example Support Request

“Hello, emails from our accounting vendor are repeatedly being classified as suspicious. The sender is billing@example.com, and the latest affected message was sent this morning around 10:30 AM with the subject ‘Monthly Statement.’ We verified the sender using our established contact information. Could you review whether these messages are being classified incorrectly?”

Important: Do not include account passwords, authentication codes, or unapproved confidential attachments in the support request.

Understanding Trusted Senders

A trusted sender is an email address or sender identity that has been recognized under the organization’s email security settings.

Trustifi provides different mechanisms for sender trust.

Trust Sender

An authorized reviewer may classify a known sender as trusted.

This can reduce unwanted spam or graymail classifications without necessarily bypassing malicious-content detection.

Allowlist

An allowlist explicitly defines senders or other identities that should receive special handling under the security policy.

Allowlisting can have broader security consequences than changing a sender’s classification to trusted.

Important: Trustifi’s Trust Sender action and sender allowlisting are not the same thing.

Trust Sender generally does not automatically allowlist the sender or prevent malicious content from being blocked.

Understanding Personal vs. Organization-Wide Trust

Depending on the permissions assigned to your account, Trustifi may support:

Personal Trust Settings

A personal allowlist or trust setting affects only your own mailbox.

Organization-Wide Trust Settings

A global trust or allowlist setting may affect multiple employees or the entire organization.

These settings are generally managed by authorized administrators or reviewers.

Important: An individual employee should not attempt to create organization-wide trust rules.

Contact True Synergy Networks when a recurring issue affects multiple mailboxes.

Why Allowlisting Should Be Used Carefully

Allowlisting may reduce or bypass certain security classifications depending on the configured policy.

This creates risks if the trusted identity is compromised or impersonated.

Example

A vendor’s email address is added to an allowlist.

Later, the vendor’s account is compromised.

An attacker sends a malicious email using that account.

Depending on the allowlist policy, the message may receive more permissive treatment.

Important: Trustifi’s allowlist settings can treat malicious links or attachments differently unless additional protective controls are configured.

This is why allowlisting should be reviewed by authorized security personnel rather than applied automatically.

What Is Smart Allowlisting?

Trustifi supports a feature called Smart Allowlisting.

Rather than relying only on a sender’s email address, the system can use characteristics of the sender’s email infrastructure to help recognize trusted messages.

How It Works

A sender is approved through the appropriate process.
Trustifi creates a signature based on the sender’s email characteristics.
Future messages are compared with that signature.
Messages matching the expected characteristics may receive trusted handling.
A mismatch can trigger further scrutiny.

This helps reduce impersonation risks.

Note: A legitimate vendor may change email providers or sending infrastructure, which can cause its signature to change.

If previously trusted messages suddenly become suspicious, contact True Synergy Networks for review.

What to Do If a Trusted Sender Is Suddenly Flagged

If a sender whose emails normally arrive without warnings begins appearing as suspicious:

Review the complete sender address.
Confirm that the message was expected.
Verify the sender using established contact information.
Do not open suspicious attachments or links.
Contact True Synergy Networks.
Explain that the sender was previously trusted.

The issue may involve:

A change in sending infrastructure.
Email authentication problems.
Suspicious message content.
A compromised sender account.
A new impersonation attempt.

Important: Do not automatically trust the message just because previous emails from the same sender were legitimate.

How to Request Review of a Recurring Sender

If a legitimate vendor’s messages are repeatedly flagged:

Step 1: Collect Examples

Gather:

Sender email address.
Recipient email address.
Two or three recent subject lines.
Approximate sending dates.
The classification shown.
Whether messages were quarantined or delivered with warnings.

Step 2: Verify the Sender

Confirm that the vendor is legitimate through a known contact method.

If possible, determine whether the vendor recently changed its email service or sending platform.

Step 3: Contact True Synergy Networks

Request a review of the recurring classification issue.

TSN can determine whether:

The message classifications are accurate.
Sender authentication is failing.
The sender’s infrastructure has changed.
A false-positive report should be submitted.
A limited trust adjustment is appropriate.

Important: Repeated false positives should be investigated rather than automatically resolved through blanket allowlisting.

Understanding Sender Authentication Problems

Sometimes legitimate messages are flagged because the sender’s email authentication is misconfigured.

Common email authentication technologies include:

SPF.
DKIM.
DMARC.

These technologies help receiving email systems evaluate whether messages are authorized to use particular sending domains.

If a Vendor Has Authentication Problems

The vendor or its email provider may need to correct its email configuration.

True Synergy Networks can help investigate available security results for your organization.

Important: Do not modify your company’s DNS records or email authentication settings to compensate for another company’s misconfiguration.

What to Do If a Legitimate Email Has a Blocked Attachment

If a message from a legitimate sender contains a blocked attachment:

Verify that you were expecting the file.
Confirm the sender through a trusted channel.
Do not ask the sender to disguise or rename a prohibited file.
Request a security review through True Synergy Networks.
Follow the approved file-sharing procedure if email delivery is not permitted.

Important: A legitimate sender can unknowingly distribute a malicious attachment.

Do not request unrestricted attachment allowlisting simply to receive one file.

What to Do If a Legitimate Website Link Is Flagged

If TSN Cyber identifies a link as unsafe:

Do not click the link.
Verify the intended website independently.
Review whether the address is spelled correctly.
Contact True Synergy Networks.
Request a review of the exact link.

Important: Do not use URL shorteners, alternate domains, or other methods to bypass link protection.

A legitimate-looking website can still be compromised.

iPhone or Android — Report an Incorrectly Flagged Email

If a suspicious warning appears in your mobile email application:

Step 1: Review the Email

Open Outlook, Gmail, or your approved mobile email app.
Locate the affected message.
Review the sender and warning without opening suspicious content.

Step 2: Use Available Reporting Controls

If your organization’s message banner includes a reporting control:

Verify that the message is legitimate.
Select the appropriate trusted-message reporting option.
Review any confirmation.
Proceed only if authorized.

If no reporting option is available, contact True Synergy Networks.

Note: Desktop and mobile reporting options may differ by application and organization configuration.

Troubleshooting

I Cannot Find the Trustifi Reporting Button

Confirm that the Trustifi add-in or approved extension is installed.
Open the affected message.
Review the available security controls.
Check whether a warning banner includes a reporting option.
Contact True Synergy Networks if no approved reporting method is available.

Note: Your organization may not enable every Trustifi reporting feature.

I Reported the Email as Safe, but It Is Still Flagged

Confirm that the reporting action completed.
Check whether the message itself remains quarantined.
Determine whether the warning applies to a sender, link, or attachment.
Contact True Synergy Networks.

Important: Reporting a classification does not guarantee that existing security restrictions will be removed.

A Sender I Trust Keeps Getting Quarantined

Confirm that the sender is legitimate.
Collect recent examples.
Check whether the classification has changed.
Contact True Synergy Networks.
Request a recurring false-positive review.

Important: Avoid requesting global allowlisting without security assessment.

I Accidentally Trusted a Suspicious Sender

If you used Trust Email or Trust Sender and later believe the sender is suspicious:

Stop interacting with the message.
Do not open any further links or attachments.
Contact True Synergy Networks promptly.
Explain which message or sender you trusted.
Request review of any personal allowlist entries that may have been created.

Important: A personal trust action can affect future email handling. It should be corrected if applied to an unsafe sender.

A Message Was Classified as Safe but Looks Suspicious

Do not assume the security classification guarantees safety.
Avoid the links and attachments.
Verify unusual requests independently.
Use the approved suspicious-email reporting process.
Contact True Synergy Networks if necessary.

Important: Even messages classified Safe can contain social engineering or fraudulent requests.

The Vendor Says Their Email System Is Working

A sender may successfully send messages while still having authentication or reputation problems that affect delivery.

Record the affected messages.
Ask the sender for the approximate sending times.
Contact True Synergy Networks.
Request an email delivery and classification review.

Note: The receiving and sending organizations may need to coordinate troubleshooting.

I Cannot Release a Quarantined Message

Check whether a Request Release option is available.
Confirm that the intended message is selected.
Submit the request if permitted.
Otherwise, contact True Synergy Networks.

Important: User permissions may restrict direct quarantine release.

Emails from Multiple Vendors Are Being Flagged

If multiple unrelated senders are suddenly affected:

Record several examples.
Confirm whether multiple employees are experiencing the issue.
Check whether a TSN service advisory exists.
Contact True Synergy Networks.

Important: Do not create broad sender allowlists to work around a widespread filtering problem.

The Trusted Sender’s Email Address Has Changed

If a vendor begins using a new email address or domain:

Verify the change through an established contact method.
Review the new complete email address.
Do not assume the new address is authorized.
Contact True Synergy Networks if messages are being incorrectly classified.

Important: Attackers sometimes impersonate legitimate vendors by claiming their email address or payment details have changed.

Best Practices for Reporting False Positives

When you believe an email was incorrectly classified:

Verify the sender independently.
Review the complete email address.
Do not interact with suspicious attachments.
Record the subject and approximate sending time.
Use the approved Trustifi reporting method.
Request release rather than bypassing quarantine.
Avoid unnecessary personal allowlisting.
Do not request blanket domain allowlisting.
Report recurring patterns to True Synergy Networks.
Remember that a legitimate sender can still be compromised.

Recommendation: A targeted security review is generally preferable to changing broad email trust rules.

Additional Information

A false positive occurs when legitimate email is incorrectly classified.
Trustifi provides user reporting features in supported Outlook and Gmail integrations.
Reporting controls may appear in the add-in or in enabled security banners.
Trustifi allows authorized users to report messages as incorrectly classified.
Some Trust Email actions can add senders to personal allowlists.
Regular users generally cannot modify organization-wide security policies.
Trust Sender and Allowlist are distinct security operations.
Smart Allowlisting helps compare trusted sender characteristics to reduce impersonation risk.
Legitimate email authentication or infrastructure changes can lead to false positives.
True Synergy Networks manages advanced classification reviews, sender trust policies, and organization-wide allowlisting decisions.

Security Reminder: Never mark an email as trusted simply to remove a warning or gain access to an attachment. Verify unfamiliar senders, unexpected payment requests, and suspicious links through a separate trusted channel. Avoid allowlisting entire domains or disabling email security controls. If you accidentally trust a malicious sender, disclose sensitive information, or suspect email account compromise, contact True Synergy Networks immediately.