What is spam email?
Definition
Spam email is unsolicited bulk email, sent to many people at once without being asked for. Most is advertising, but spam is also a common way to deliver phishing links and scams.
- Category
- Scams
- Also called
- spam emails, junk email, unsolicited email
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: consumer.ftc.gov, csrc.nist.gov
Last verified against the official page:
NIST's glossary defines spam as electronic junk mail, and its older sources describe it as unsolicited bulk commercial email messages. The key parts are that you didn't ask for it and that the same message goes to a large number of people.
Not all spam is dangerous. A lot of it is plain advertising for products you have no interest in. The risk comes from the part that tries to trick you. A spam message can carry a link to a fake login page, an attachment, or a made-up story about your account or a payment. That is phishing, and the FTC lists the usual signs: a generic greeting, an invented problem with an account, a request to click a link to update payment details, typos and bad grammar, or a sender you have no account with.
How spammers get your address
Spammers buy lists, scrape addresses from websites and forums, guess common address patterns, and reuse addresses leaked in data breaches. An address that appears on a public page or in a data broker profile is easy to collect. Once it is on one list it tends to end up on many.
A typical example
An email arrives from a company you have never used. It says a payment failed and asks you to click a button to fix it. There is no name in the greeting, and hovering over the button shows a web address that has nothing to do with the company. The FTC's advice for this case is not to click, and to contact the company using a phone number or website you already know is real.
Spam vs. phishing
Spam describes how a message is sent: unwanted and in bulk. Phishing describes what it is for: tricking you into giving up information or money. A phishing email can be sent as spam, but a targeted one (spear phishing) is sent to one person and isn't spam in the bulk sense. Many spam messages are harmless ads, and many phishing messages are spam.
How to protect yourself
- 1
Don't click links or open attachments in unexpected emails
The FTC says to avoid clicking links or opening attachments in messages you didn't expect. If an email might be real, contact the company using a phone number or website you already know is genuine.
- 2
Hover over a link before you act
Hovering over a link without clicking shows where it really goes. If the address doesn't match the company it claims to come from, treat the email as a scam.
- 3
Report phishing, then delete it
The FTC says to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to report the scam at ReportFraud.ftc.gov, then delete the message.
- 4
Act fast if you already clicked or replied
The FTC says to update your security software and run a scan. If you gave out a Social Security, credit card or bank account number, go to IdentityTheft.gov for a recovery plan.
- 5
Keep your address off public pages
The fewer places your email address and name are listed, the fewer lists you land on. Serus finds where your personal details are listed and removes them, and keeps watching for new exposures.
See it in action
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is spam email illegal?
It depends on the country and on the message. Rules differ between places, so check your national regulator for details. Scam and phishing emails are fraud whatever the local spam rules say.
Why am I getting so much spam?
Your address has probably been collected from a public page, bought on a list, or leaked in a data breach. Once on one list it spreads to others, which is why volume tends to rise over time.
Should I click unsubscribe on spam?
Only for mail from a company you know and used. For unexpected messages, the FTC advises against clicking links in them, so report and delete instead.
How do I report spam and phishing emails?
In the US, forward phishing emails to reportphishing@apwg.org and report the scam to the FTC at ReportFraud.ftc.gov. Outside the US, use your national fraud-reporting body.
Sources
Something wrong or out of date? Tell us and we'll re-check it.