What is spam?

Spam is the electronic version of “junk mail.” The term spam refers to unsolicited, often unwanted, email messages. Spam does not necessarily contain viruses so some valid messages from legitimate sources could fall into this category.

How can you reduce the amount of spam?

• Be careful about releasing your email address
  

  Think twice before you respond to any request for your email address, on the web, verbally, or on paper.
  Spammers can harvest any email address posted on a website or buy a list of victims from unscrupulous vendors who sell their mailing list.
  When you give your email address to a company, or a store, that information is often entered into a database so that customer information and preferences can be tracked. If these email databases are sold to or shared with other companies, you can receive email that you didn’t request.
  So the next time you make a purchase and they ask you whether you want an emailed or a printed receipt, choose “Print only”.

• Check privacy policies

  Before submitting your email address online, look for a privacy policy. Most reputable sites will have a link to their privacy policy from any form where you’re asked to submit personal data.
  You should read this policy, whenever possible, before submitting your email address or any other personal information so that you know what the owners of the site plan to do with the information (see Online Privacy: Protecting Personal Information On The Internet for more information).

• Be aware of options selected by default

  When you sign up for some online accounts or services, there may be a section that provides you with the option to receive email about other products and services. On a lot of websites, options to be spammed by their “marketing associates and partners” are selected by default – that is, they automatically check the box on your behalf.
  So, if you do not say no by unchecking that box, you could begin to receive email from those lists as well.

• Use filters or spam tagging

  Many email programs, like GMail or Microsoft Outlook for example, offer filtering capabilities that allow you to block certain addresses (also called a block list, or blacklisting), or to allow only email from addresses on your contact list – sometimes referred to as a trusted senders list.
  This is a powerful feature because it tells the email server that you regard the email as unsolicited. On email clients that support it, you should see those emails tagged as “[SPAM]” in your Inbox.
  Many managed technology service providers (MSPs) who provide email hosting services also offer spam tagging services that allow the user the option to review suspected spam messages before they are deleted.
  Spam tagging can be useful in conjunction with email filtering capabilities provided by many email programs.

• Report messages as spam

  Most email clients offer an option to report a message as spam or junk. If your email client has that option, take advantage of it. In Microsoft Outlook, Reporting messages as spam or junk helps to train the mail filter so that the messages aren’t delivered to your inbox.
  However, check your junk or spam folders occasionally to look for legitimate messages that were incorrectly classified as spam.

• Don’t follow links in spam messages

  Some spam relies on generators that try variations of email addresses at certain domains. If you click a link within an email message or reply to a certain address, you are just confirming that your email address is valid.
  This is even more apparent in those spam emails that ask you to reply with a “Stop” to be removed from their list. Do not do it.
  Unwanted messages that offer an “unsubscribe” option are also particularly tempting, but this is often just a method for collecting valid addresses that are then targeted for other spam.

• Disable the automatic downloading of graphics in HTML mail

  Many spammers send HTML mail with a linked image or picture file that is then used to track who opens the email message. When your mail client downloads the image or picture from their web server, the spammers know you’ve opened the message. Disabling HTML mail entirely and viewing messages in plain text also prevents this problem.

• Consider opening an additional email account

  If you frequently submit your email address to vendors, for online shopping, signing up for services, or including it on something like a comment card, you may want to have a secondary email account to protect your primary email account from any spam that could be generated.
  You could also use this secondary account when posting to public mailing lists, social networking sites, blogs, and web forums.
  If the account start to fill up with spam, you can get rid of it and open a different one.
  The most common or well-known free email account providers are Gmail and Microsoft Outlook and Yahoo Mail, and they offer users reliable and easy-to-use features.
  There are also providers like 10-Minute Mail, and ProtonMail that caters to specific needs like privacy and security.
  When picking a free email service, consider what features are important to you, like security, data storage, or add-ons like video conferencing.

• Use privacy settings on social networking sites
  

  Social networking sites typically allow you to choose who has access to see your email address. Consider hiding your email account or changing the settings so that only a small group of people that you trust are able to see your address. (See Staying Safe on Social Networking Sites for more information).
  Know that when you use applications on these sites, you may be granting permission for them to access your personal information.
  So, be cautious about which applications you choose to use.

• Don’t spam other people

  Be a responsible and considerate user. Some people consider email forwards a type of spam, so be selective with the messages you redistribute. Don’t forward every message to everyone in your address book, and if recipients ask that you not forward messages to them, respect their requests.

Authors:

CISA

Content for this article is sourced from The Cybersecurity and Infrastructure Security Agency (CISA).