Spam is unsolicited bulk email sent to many people at once, usually to sell something or trick you into giving up information

Spam is email you did not ask for, sent by someone you do not know, usually in large batches to thousands of addresses at once. The sender's goal is almost always to make money — either by selling you something, getting you to click a malicious link, or stealing your passwords and financial information. Spam is not a mistake or a misdirected message. It is a deliberate choice to send unwanted mail because the sender knows that even a tiny response rate makes the effort profitable.

Spam differs from a legitimate marketing email you signed up for. When you buy something online and the company sends you a receipt, that is not spam — you gave them permission. When you subscribe to a newsletter and later want to unsubscribe, there is usually an unsubscribe link at the bottom. Spam has no such link, or the link does not work, because the sender does not want you to stop receiving it.

Key Takeaways

  • Spam is unsolicited bulk email, usually sent to thousands of addresses at once, with the goal of making money from a small percentage of responses.
  • Common spam types include product sales pitches, phishing attempts that steal passwords, fake invoices, and romance scams that build trust before asking for money.
  • Spammers obtain email addresses by buying lists, scraping websites, guessing common address patterns, or harvesting addresses from data breaches.
  • Your email provider filters most spam automatically, but some still reaches your inbox because spammers constantly change tactics to evade filters.
  • Replying to spam, clicking unsubscribe links, or confirming your address exists makes you a target for more spam, not less.

How spammers get your email address

Spammers do not need your permission to send you email — they just need your address. They obtain addresses in several ways. The most common is buying lists from data brokers or other spammers who have compiled addresses from public sources, previous data breaches, or people who sold their contact information. A single list of millions of addresses might cost a few hundred dollars, making the math work even if only 0.1 percent of recipients respond.

Spammers also harvest addresses directly from websites. If your email appears on a public page — a business website, a forum post, a comment section — automated tools can scrape it and add it to a spam list. They also use pattern guessing: if they know your name and your email provider, they can guess common address formats like firstname.lastname@provider.com or firstnamelastinitial@provider.com and send to thousands of guesses at once, knowing some will be real addresses.

Data breaches are another major source. When a company is hacked and customer information is stolen, that data often ends up for sale on the dark web. Spammers buy it and use the email addresses for targeted campaigns. This is why you may suddenly receive a spike in spam after a breach at a company where you had an account.

Common types of spam you will see

Product sales spam is the most visible kind. You receive emails offering weight loss pills, luxury watches, designer handbags, or other goods at prices that seem too good to be true — because they are. The products either do not exist, are counterfeit, or are so cheap that the sender makes money on volume. The sender has no intention of providing customer service if something goes wrong.

Phishing spam is more dangerous. These emails impersonate banks, payment services, social media platforms, or other companies you use. They tell you your account has been compromised, your payment method failed, or you need to confirm your identity. The email includes a link that looks like it goes to the real company but actually goes to a fake website controlled by the scammer. When you enter your username and password, the scammer captures it and uses it to access your real account.

Invoice and payment scams target businesses. You receive an email that looks like it comes from a vendor you work with, asking you to update payment information or wire money for an urgent invoice. The sender has researched your company enough to sound legitimate, but the bank account or payment details belong to them.

Romance scams build trust over weeks or months. Someone creates a fake profile, starts a relationship with you, and eventually asks for money for an emergency — a medical bill, a plane ticket, a business problem. By the time they ask, you feel invested in helping them.

Why spam still reaches your inbox even with filters

Email providers like Gmail, Outlook, and Yahoo use sophisticated filters to catch spam before it reaches you. These filters look at sender reputation, message content, links, attachments, and whether the email matches patterns of known spam. Most spam never makes it to your inbox — it goes straight to a spam or junk folder.

But spammers are constantly adapting. They change the wording of emails to avoid filter keywords. They use new sender addresses and domains. They hide malicious links behind legitimate-looking text. They send from compromised legitimate email accounts, which makes the email look trustworthy to filters. For every improvement email providers make to their filters, spammers develop new techniques to get around them.

Some spam reaches your inbox because the filter made a judgment call and got it wrong. A legitimate email might look like spam, or spam might look legitimate enough to pass through. This is why you still see spam even though your provider is filtering millions of messages.

Why you should never reply to spam or click unsubscribe

When you reply to a spam email, you confirm to the sender that your address is active and monitored by a real person. That makes your address more valuable — spammers will sell it to other spammers, and you will receive more spam. The same is true if you click an unsubscribe link in a spam email. Legitimate marketing emails have real unsubscribe links that work. Spam unsubscribe links often do not work, or they confirm your address and add you to more lists.

Clicking links in spam emails is also dangerous. Even if the link does not take you to a phishing site, it may read malware, add you to a tracking list, or confirm your address to the sender. The safest approach is to delete spam without opening it, or to mark it as spam in your email provider so the filter learns to catch similar messages in the future.

The difference between spam and legitimate marketing email

Legitimate marketing emails come from companies you have a relationship with or have explicitly asked to hear from. They include a real unsubscribe link that works when ready. They come from a consistent sender address and domain that you can verify. They do not ask you to click a link to confirm your password or payment information — legitimate companies already have that information.

Spam does not have these features. It comes from unfamiliar senders, uses generic greetings like "Dear Customer" instead of your name, asks you to click links or read attachments, and often contains spelling or grammar errors. The sender address may look similar to a real company but with a slight variation — like amaz0n.com instead of amazon.com.

If you are unsure whether an email is legitimate, do not click any links in it. Instead, go directly to the company's website by typing the address into your browser, or call their customer service number from a phone bill or statement you have on file. This way you know you are contacting the real company, not a scammer.

How your email provider protects you from spam

Email providers use multiple layers of protection. They maintain lists of known spam sources and block email from those addresses. They scan attachments for viruses and malware. They analyze the content of emails for common spam phrases and suspicious patterns. They check whether the sender's domain is legitimate and whether the email has been forged to look like it came from somewhere it did not.

They also use machine learning, which means the filter improves over time by learning from millions of emails. When you mark an email as spam, you are teaching the filter to recognize similar messages in the future. When you mark a legitimate email as not spam, you are teaching the filter not to block similar messages from that sender.

Despite these protections, no filter is perfect. Some spam gets through, and some legitimate email gets caught. This is why it is worth checking your spam folder occasionally to make sure nothing important was filtered by mistake.

Frequently Asked Questions

Is it safe to open a spam email?

Opening a spam email to read it is usually safe — the danger comes from clicking links or downloading attachments. If you open an email and do not interact with it, nothing happens. However, some advanced spam uses invisible images to confirm your address is active, so it is still better to delete spam without opening it when possible.

What should I do if I clicked a link in a spam email?

If you clicked a link but did not enter any information, you are likely fine. If you entered a password or payment information, change that password when ready and monitor your account for suspicious activity. If the email impersonated your bank or payment service, contact them directly using a phone number from your statement to report the incident.

Why do I get spam in my work email but not my personal email?

Work email addresses are often public — they appear on company websites, business cards, and directories. Personal email addresses are usually private unless you have shared them publicly or they were exposed in a breach. The more public your address is, the more likely spammers will find it.

Can I stop spam completely?

No, but you can reduce it significantly. Use your email provider's spam filter, mark unwanted emails as spam, avoid posting your address publicly, and do not reply to or unsubscribe from spam. If spam becomes overwhelming, you can create a new email address and share it only with people and services you trust.

Is spam illegal?

In many countries, including the United States, sending unsolicited bulk email is regulated by laws like the CAN-SPAM Act. However, enforcement is difficult because spammers often operate from countries with weak enforcement, use fake identities, and move quickly to new addresses when caught. Your email provider's filters are more effective than law enforcement at stopping spam.