Embodiments of the invention provide a system and methods for filtering electronic messages having data therein identifying a link to a remote processing system. One embodiment provides a method which includes interrupting the transmission of the electronic message, identifying a link within the electronic message, and analyzing the electronic message on the basis of at least one of an attribute of the link and of at least an attribute intrinsic to the received electronic message so as to classify the message as either a suspect message or acceptable message. The method further includes modifying the electronic message so as to replace the link with an alternative network location corresponding to a remote processing system different from that corresponding to the link if the message is classified as a suspect message. The method further includes transmitting the electronic message unmodified if the message is classified as an acceptable message.