Spam email is unsolicited bulk messages sent to many people at once, usually to sell something, trick you into revealing information, or infect your device with malware

Spam is mail you never asked for, sent by someone you don't know, often to thousands of people simultaneously. The sender's goal is usually profit: they want to sell you something, get you to click a malicious link, steal your passwords or financial details, or use your computer to send more spam. Unlike a single unwanted email from a person, spam is a mass operation — the sender's cost per message is nearly zero, so they only need a tiny fraction of recipients to respond to make money.

The term "spam" comes from a 1970s Monty Python sketch about a canned meat product that drowns out all other conversation. Email spam works the same way: it overwhelms your inbox with noise, making it harder to find real messages. Most email providers now filter spam automatically, but understanding what it is and how it arrives helps you recognize it when it slips through.

Key Takeaways

  • Spam is sent in bulk to many recipients at once, not targeted to you personally, and the sender profits only if a small percentage respond.
  • Common spam types include product sales pitches, phishing attempts designed to steal passwords, and malware attachments that infect your device.
  • Spammers harvest email addresses from public websites, data breaches, and by guessing common name patterns at popular email providers.
  • Replying to spam, clicking unsubscribe links, or confirming your email works confirms your address is active and leads to more spam.
  • Email filters catch most spam before it reaches your inbox, but no filter is perfect, so learning to spot spam yourself is a useful backup.

How spammers get your email address

Spammers build mailing lists by harvesting addresses from anywhere they are publicly visible. If your email appears on a website — a business directory, a forum post, a social media profile, a comment on a blog — automated tools can scrape it and add it to a list. The same happens when your address is exposed in a data breach; stolen email lists are bought and sold on the dark web, often bundled with passwords and other personal details.

Spammers also use pattern-guessing software to generate addresses based on common name combinations at major providers like Gmail, Yahoo, and Outlook. If your name is John Smith, a spammer might try john.smith@gmail.com, jsmith@gmail.com, johnsmith1985@gmail.com, and thousands of similar variations. Most guesses fail, but the cost is so low that even a 0.1% success rate is profitable.

Once your address is on a list, it may be sold to other spammers or used repeatedly by the same sender. This is why spam often comes in waves — your address has entered the market, and multiple operations are now targeting it.

The main types of spam you will encounter

Product and service spam is the most common kind. You receive unsolicited emails advertising weight-loss pills, luxury watches, mortgage refinancing, online degrees, or other products and services. The sender has no relationship with you and does not care whether you want the product — they are counting on the fact that out of thousands of recipients, some will be curious enough to click and buy.

Phishing spam pretends to be from a company you trust — your bank, PayPal, Amazon, Apple, or your email provider itself — and asks you to "verify your account," "confirm your password," or "update your payment method." The link in the email leads to a fake website that looks like the real one. When you enter your credentials, the attacker captures them and uses them to access your real account. Phishing is dangerous because it exploits trust; you are more likely to click a link that appears to come from your bank than from a random sender.

Malware spam contains an attachment or link designed to infect your device. The attachment might be labeled as an invoice, a package delivery notice, or a resume, but opening it installs software that steals data, locks your files for ransom, or turns your computer into a tool for sending more spam. These emails often create false urgency — "Your package could not be delivered" or "Unusual activity detected on your account" — to make you act quickly without thinking.

Advance-fee scams promise you money — a lottery prize, an inheritance, a job offer with a signing bonus — but require you to pay a fee upfront or provide banking details to claim it. The money does not exist; the goal is to steal your payment or your account information.

Why spammers succeed despite filters

Email providers use multiple layers of filtering: they check sender reputation, scan for known malware signatures, look for phishing patterns, and use machine learning to spot new spam tactics. Gmail, Outlook, Yahoo, and others block billions of spam messages daily before they reach your inbox. But filters are not perfect, and spammers are constantly adapting.

Spammers use techniques to evade filters: they misspell words ("V1agra" instead of "Viagra"), use images instead of text so filters cannot read the content, rotate through thousands of sender addresses so no single address gets flagged, and send from compromised legitimate email accounts that have not yet been detected. They also buy lists of addresses that have previously engaged with spam, because those addresses are less likely to be honeypots — fake addresses set up by email providers to catch spammers.

The economics of spam mean that even a tiny success rate is worth the effort. If a spammer sends one million emails and 0.01% of recipients click a link or buy a product, that is 100 conversions. At even a small profit per conversion, the operation pays for itself many times over. The sender has no cost if the email bounces or gets filtered; they only profit from the ones that get through.

How to recognize spam in your inbox

Legitimate companies you do business with send you email you signed up for — order confirmations, account statements, newsletters you subscribed to. Spam arrives unsolicited. If you do not recognize the sender and did not ask for the message, it is probably spam.

Watch for red flags: generic greetings like "Dear Customer" or "Dear Friend" instead of your name; urgent language demanding when ready action; requests for passwords, credit card numbers, or other sensitive information; suspicious links or attachments; poor grammar or spelling; and sender addresses that do not match the company name (like "paypal-security@randomdomain.com" instead of an official PayPal address).

Phishing emails often ask you to click a link to "verify," "confirm," or "update" something. Legitimate companies rarely ask you to click a link in an email to enter sensitive information; they usually ask you to log in directly through their official website or app. If you are unsure, go to the company's website directly by typing the address into your browser, rather than clicking the link in the email.

What happens if you respond to spam

Replying to spam, even to ask the sender to stop, confirms that your email address is active and monitored by a real person. This makes your address more valuable to spammers and leads to more spam, not less. The same is true for clicking an "unsubscribe" link in a spam email — if the unsubscribe is real, it confirms your address; if it is fake, clicking it may trigger more spam or expose you to malware.

Legitimate marketing emails from companies you have done business with do include real unsubscribe links, and using them is safe and effective. The difference is that you signed up for those emails in the first place. With unsolicited spam, unsubscribing does not work because the sender is not operating a legitimate mailing list — they are running a scam or a bulk operation with no real unsubscribe mechanism.

If you receive a phishing email, do not click any links or read any attachments. Instead, report it to your email provider (Gmail, Outlook, and Yahoo all have report buttons) and delete it. If the email claims to be from your bank or another financial institution, you can also forward it to their fraud department — most banks publish an email address for this purpose on their website.

How email filters protect you

Your email provider scans incoming messages against known spam patterns and sender reputation databases. If a sender has a history of sending spam, their messages are filtered automatically. Gmail, for example, blocks over 99.9% of spam, phishing, and malware before it reaches your inbox, according to their own reporting.

Filters also look at the content of the message. If an email contains common phishing language ("verify your account," "confirm your password") or known malware signatures, it gets flagged. Machine learning models trained on billions of emails help providers spot new spam tactics that have not been seen before.

You can also set up your own filters in most email clients. In Gmail, Outlook, and Yahoo, you can create rules that automatically delete, archive, or label emails from specific senders or containing specific words. This is useful if you notice a particular spam sender or topic keeps getting through the main filter.

Frequently Asked Questions

Is it safe to open a spam email if I do not click any links?

Opening and reading a spam email is usually safe — the danger comes from clicking links or downloading attachments. However, some sophisticated malware can execute just from opening an email with a specially crafted image or code. The safest approach is to delete spam without opening it, but if you have already opened it and did not click anything, you are almost certainly fine.

What should I do if I think I clicked a phishing link?

Change your password for that account when ready, using a device you trust and a find internet connection. If you entered your password or financial information, contact the real company (use the phone number or website from your statement, not from the email) and let them know. Monitor your account for suspicious activity. If the phishing email was convincing, consider changing passwords for other accounts that use the same or similar passwords.

Why do I get spam even though I have never given my email to anyone?

Your address may have been exposed in a data breach, scraped from a public website, or generated by pattern-guessing software. You do not have to have shared your email for spammers to find it. Once it is on a list, it circulates among multiple spammers and may be targeted for years.

Can I stop spam completely?

No, but you can reduce it significantly. Use a separate email address for online shopping and signups, keep your primary address private, and avoid posting your email publicly. Mark spam as spam in your email client so filters learn your preferences. Do not reply to or engage with spam. Most importantly, use strong, unique passwords so that if your address is exposed in a breach, attackers cannot access your accounts.

Is it true that unsubscribing from spam makes it worse?

Unsubscribing from unsolicited spam can make it worse because it confirms your address is active. However, unsubscribing from legitimate marketing emails — ones you signed up for from real companies — is safe and effective. The key difference is whether you originally asked to receive the emails.