There may be times when tickets are flagged to bring attention to a potential risk. For example, depending on your account setup, tickets might be flagged when an unknown user adds a comment or the ticket is submitted by a user who isn't signed in.
When a ticket is flagged, it means that a flag appears underneath a comment in the ticket. The ticket is not flagged in any ticket views.
Your workflow isn’t affected when tickets are flagged, but there are certain actions you can take to handle flagged tickets. Read this article to understand when tickets are flagged and the options available to handle them.
Understanding when tickets are flagged
Tickets may be flagged when a customer submits a ticket without signing in or when an unknown user, who was not added to the ticket as a CC, updates an existing ticket.
-
Flagged tickets from
registered users who are not signed in
With an open Zendesk Support instance, you can allow customers to submit tickets without registering for an account or signing in to an existing account. This lets your customers get help quickly without taking extra time to register or sign in.
However, if a customer submits a ticket without signing in, it will be flagged. This is done because the user supplies an email address when they submit the ticket, and it is relatively easy for a user to pretend to be someone else by using an email address they don't own. There's an inherent risk that comes with allowing ticket submission by users who are not signed in, and it can be an opportunity for social engineering.
-
Flagged tickets from
unknown users who are not explicitly added to the ticket
Tickets are also flagged if an unknown user, who was not added to the ticket by the requester or an agent as a CC, updates an existing ticket. The unknown user’s comment is flagged and added to the comment stream as a private note. Most likely, the email was forwarded by the requester to an unknown user or to an unverified email account (such as a secondary email address) and then replied to.
Handling flagged tickets
Consider the following options when handling a flagged ticket.
- If you're comfortable with the comment, ignore the warning flag and handle the ticket as you normally would. You cannot remove the flag.
- If you're not comfortable with the comment, you can raise a concern with your
manager or consider temporarily suspending the user.
Depending on the nature of the comment, you might want to raise a concern about the ticket with your manager. Also, you can consider temporarily suspending the user, to prevent them from submitting more tickets, until you can investigate and feel comfortable enough to reinstate the user. (See Suspending a user).
- To allow the new user to comment publicly on the ticket, an agent, the requester, or a CC on the ticket must add the user as a CC. The Make email comments from CCed end users public (not recommended) option must also be enabled. See Changing the default comment privacy for end user CCs for why we don't recommend enabling this option.
14 comments
Tommy
Hi Jennifer,
Is there any way to add this flag from the Zendesk API? Currently when I try to do it, it adds the flag to the 'custom' section of the metadata, as opposed to actually editing the 'flags' section of the metdata? Thanks!
0
Ksenia Shanyuk
Reference above, we have some users who have multiple sites with us. And at times they raise tickets from a different email domain, i do not recall below message pops before, but will this fall under this scenario where it is just ZD flagging the fact the the ticket is raised by a person with a different email address as opposed to what is registered under this particular site?
0
Justin Near
How do you remove the flag "This ticket is flagged as a potential risk"?
0
Matan Arik
I'm a little confused as to why it suddenly started happening after over a year. But every ticket from our typeform is now being flagged.
How can we remove this potential risk flagging?
Can we not have a - This message is not suspicious for me to cancel it?
Or have the allowlist option to affect "This message is suspicious"?
0
Anne Ronalter
it seems like both of you are referring to the new feature that has already been rolled back due to customer Feedback which is using ticket alerts to help defend against email phishing attacks.
You can read more about it in this article:
https://support.zendesk.com/hc/en-us/articles/4538847988378--Rolled-back-Using-ticket-alerts-to-help-defend-against-email-phishing-attacks
0
Michi Moskovitz
Hi
re: "Tickets are also flagged if an unknown user, who was not added to the ticket by the requester or an agent as a CC, updates an existing ticket. The unknown user’s comment is flagged and added to the comment stream as a private note"
why would we create a private note? This came from an end user. It's very confusing this way.
3
Donald Clark-Charest
I noticed that flagged messages do not reopen the ticket. I'm not exactly sure if this is intended. If so, is there a workaround to ensure they do open the ticket, perhaps with a trigger? I tried a few things without success.
To clarify the scenario, we sometimes CC one of our many associates that don't use Zendesk. Sometimes these associates forwards the email to another email which they use to reply to us. It is essential that when we receive the reply that it reopens the ticket.
1
Dekbi
I will be creating a ticket regarding this so we can discuss this further. Please expect an email once the ticket has been created.
0
Hector Jimenez
Hi Dekbi any update on this? CC'd customers in my companies tickets are also being logged as internal comments and it's causing serious issues within our communications to a group of customers in a ticket.
4
Kelli Papendick
+1 to Hector's comment above. It's causing a communication disruption with client tickets. Thanks in advance for an update!
0
Iris Edwards
Hi Debki,
Any update on this?
0
Marci Abraham
Me too! We have attempted to handle this by bumping up the priority on tickets that get a reply from an end user who was not on the ticket, but it's really not working effectively. We do not want to accept all CC's because that would also cause chaos. But would love to see a middle ground somewhere.
0
Kathy Bazley
Hi, was there an update on this? It is impacting our team as well. Would love to find some insight.
0
O'Connor, Finbarr
Hi,
Would also like to see an update on this one (and it happens regularly when dealing with larger companies). Non cc'd person replies to ticket with important information to then be excluded from the reply resulting in complaints of email updates going missing.
Additionally; if the functionality isn't going to change then can the flag warning be put at the top of their reply. Zendesk tickets, by their nature can become very log so it's easy to miss that ‘XXXX was not a part of this conversation.’ message and therefore exclude them in your reply
0