How Do The Spammers Get Your Email Address?

Is Your Email Address Vulnerable to Spammers?

Spammers, scammers, and other cyber-miscreants appear to have supernatural powers that enable them to guess email addresses accurately and quickly. Or maybe they've got an army of robodogs digging for vulnerable inboxes. But in reality, the bad guys harvest email addresses by pretty mundane means. YOU may even be contributing to the problem without realizing it. Let’s dig in to this problem to see what can be done to limit the flow of that ubiquitous digital canned lunch meat. Here are some of the methods spammers use to vacuum up email addresses, starting in Margaritaville.

Are You The Problem? - With apologies to Jimmy Buffett, some people claim that there's a hacker to blame, but you know, it's your own damn fault sometimes. Many people simply hand over their email addresses, no questions asked, just to get access to a game, contest, some free program, a ringtone, or other supposed "valuable prize." It's a good idea to have a "throwaway" email address that you can enter into Web forms, rather than using your everyday address. See my related article Yes, You Do Need a Disposable Email Address.

If you have an email password that's easily guessable, someone may hack into the email account and steal all of the contacts stored there. If your computer is not adequately protected from viruses, spyware and phishing attacks, all of the people in your email address book are vulnerable to spam attacks as well. See my article Here's the END of Weak Passwords for help picking a secure password.

Web Crawling and Harvesting - Spammers use automated programs, called "spiders," to crawl the web just like search engines do. These spiders scan websites, forums, blogs, and online directories for the "@" symbol, rapidly logging millions of addresses. To avoid this, never post your real email address on public pages. If it's included in online directories (school, work, clubs, etc.) ask to have it removed. If it must appear online, obscure it. For example, write "janedoe at gmail dot com," use images instead of text, or, better yet, use a disposable address for anonymity. Tip: Search your own address in Google (in quotes) to see if it’s exposed publicly.

Dictionary Attacks - "Dictionary attacks" are another way to collect email addresses. This method, which combines common words with popular domain names, relies on the fact that you don’t need a valid email address to generate an outgoing email. Spammers generate emails to computer-generated addresses, accepting millions of bounce-backs in exchange for a handful of replies from valid addresses. That's why the first rule of dealing with spam is "don't reply to it." Doing so just tells the spammer that you are a "live one" and worth hitting with more spam. Delete that unwanted message, or banish it to the Trash folder.

You can make it harder for a dictionary attacker to guess your address by NOT choosing any combination of dictionary words, common first or last names, and a string of numbers. If your email address is smith123@aol.com or susie90210@gmail.com I can guarantee that you'll get loads of spam, no matter how careful you are. Those addresses are just easy targets, because they're so easy to guess.

Email Forwards and CC Abuse - Mass-forwarded emails, especially those listing all recipients in the TO: or CC: fields, are gold mines for spammers if any recipient’s device or account is compromised. Always use BCC: for group messages to keep recipient lists private.

This may or may not be a major source of email address harvesting, but at the very least, you must agree that blindly forwarding every silly story doesn't contribute anything positive to the Internet. Cambodian midgets fighting lions? Nigerian prince wants your help transferring millions? Really?? If you're tempted to forward something that seems dubious, check it out with a quick search before hitting that Send button.

Data Breaches: The Big Leaks - Major hacks, like those affecting Yahoo, Equifax, and countless corporate giants (Target, Chase Bank, American Express, Home Depot, Apple, Sony and others) have yielded millions of email addresses to criminals. In recent years, high-profile breaches have only accelerated, sometimes resulting in databases including email addresses, personal info, and even passwords being sold or traded on the dark web for as little as $100 per million addresses.

The Big Kahuna of Data Breaches was reported in September 2017. The Equifax hack was especially damaging, because it revealed names, addresses, Social Security Numbers, birth dates, driver’s license data, credit card numbers, and email addresses. Since then, high-profile data breaches revealing untold millions of customer records have become a common occurrence. By combining all of that data, Bad Guys and their AI-powered bots can create much more sophisticated and compelling email scams.

Selling and Sharing Lists - Some websites and online businesses sell or "share" mailing lists with "affiliated marketers," sometimes without the users’ clear knowledge or consent. Always read the privacy policy before submitting your email address online and opt out from third-party sharing whenever possible.

Recent Trends in Spam Tech

Artificial intelligence, social engineering and other tactics are being used to extract email addresses from humans that are weary of defending their inboxes. Consider these five points:

AI-powered spam: Spammers increasingly use artificial intelligence to generate targeted (and convincing) phishing emails and automate harvesting at scale.

Leaked data from AI chatbots: Malicious actors have attempted to exploit security lapses in chatbots and AI services to scrape or expose user email data.

QR code phishing: Attackers now use QR codes embedded in emails to lure users to phishing sites, stealing both login credentials and emails.

Consent fatigue: With more required opt-ins, people overlook consent pop-ups, unintentionally giving email sharing permissions.

Social Engineering Via Social Media: Some spammers directly message users or scrape public social media posts where email addresses may be listed for networking, resumes, or business promotions.

How to Protect Your Email

It's almost impossible to hide your email address from spammers completely. But you can reduce the attack surfaces. The fewer entities that have your email address, the less spam you will receive. Never reply to suspicious or unsolicited emails. Always use BCC: for group communications. Use strong, unique passwords and enable two-factor authentication. Think (and read the privacy policy) before you give your email address to any website. Using a disposable email address, keeping your own computer secured, and encouraging your friends and family to do likewise will also help.

Even if you can’t fully block all spam, while keeping your address private, you can significantly reduce your exposure. Fewer people and sites with access to your main address mean less spam in your inbox.

Got any additional tips for keeping your email address safe? Post your comment or question below...