Checking conversation links

When you hover over URLs in the Inbox (e.g. inbound or outbound conversations and teammate notes), you will see a tooltip appear that gives a URL preview. This is especially helpful for hyperlinked text and images.

If you click on an untrusted link, you'll see the following warning screen:

To reduce risk around clicking malicious links that may be hidden in conversations in the Inbox, we recommend you always take a moment to check the URL to confirm it is something you would expect to see and it seems safe.

This includes links that have been:

Intercom scans incoming links for malicious content.

If you click a malicious link from the Inbox, you will see a different warning screen appear:

Similar to the untrusted link warning, this screen will allow you to continue to the potentially malicious site by checking the Accept risk box and clicking the Open link button.

Go to Settings > Workspace > Security and click on Links to update your link security settings. 👇

This granular control ensures you can define your own risk tolerance, significantly enhancing phishing prevention and Inbox security by:

The following domains are trusted by default:

You can add your own domains by selecting Add policy and entering the domain, then mark it as blocked/trusted and click Save policy.

Link warnings are active by default unless you have explicitly chosen to deactivate them.

By configuring your trusted domains, you can reduce how often your teammates see link warnings; only showing them on domains you don’t know and don’t trust. However, you may still wish to deactivate link warnings, e.g. if you have your own security measures in place that reduce the risk of teammates clicking potentially malicious links.

Teammates with permission to manage Security settings can disable these warnings in the Attachments and Links section in Security settings. When you disable link warnings you’ll see your name and the timestamp recorded in the Settings page and activity logs.

Teammates with the “Can manage general and security settings” permission can also block domains, subdomains or specific URLs from within your Workspace Security settings.

Clicking on a link to a blocked domain/URL will show a “blocked” screen.

This screen does not offer an option to accept the risk and continue, and the block policy must be removed from the Workspace Security settings to re-enable the link.