4.2.5 Phishing Message Functionality Enabled By the User
If the PidNamePhishingStamp property ([MS-OXPROPS] section 2.461) is present, the client will compare its STAMP field, as specified in section 220.127.116.11, with the least significant 28 bits of the PhishingTagValue value. If the PidNamePhishingStamp property value is 0x1E241D99 and the PhishingTagValue value is 0xAE241D99, the comparison results in a match, which indicates that the message is likely to be a phishing message. Because the value of the ENABLED field, as specified in section 18.104.22.168, of the PidNamePhishingStamp property is 1, the user has enabled functionality within the message. Therefore, the client will treat the message as though it is not a phishing message.