Want to get rid of spam? Be careful how and where you unsubscribe!

Since email has become a very popular work tool, malicious actors use it quite a lot to launch all kinds of attacks.

Spam messages are everywhere, and hackers flood every email address they can find with them.

If the message you receive is spam and you unsubscribe from it, you confirm that the email address is valid and in use.

According to an article published in May 2021 by Bleeping Computer, an increasingly common practice at the time was sending spam with an unsubscribe link at the end of the email. Once the link was clicked, the hacker got confirmation that the email address was valid and actively used, so they added it to new spam campaigns. The risk still applies today.

In some cases, the email you receive contains nothing but a message or an unsubscribe link. By replying to it, all you do is let the attackers know you use that email address.

Bleeping Computer even ran a test on this. They created a new email address and replied to one of the unsubscribe messages. The result: new spam started arriving at the newly created address, which hadn’t been used for anything before.

IT security: tell me more →

To identify spam messages, you can read the article on how to check whether an email is spam, written by one of our security specialists.

How we can protect ourselves from spam attacks and compromised email accounts:

• turn on two-step verification for your mailboxes – if the malicious message aims to steal your login details, they’re much harder to use when two-step verification is on, especially with an authenticator app or a security key;
• use a high-performance antivirus and antispam solution on the email server – many spam messages can be identified directly by the email server, before they ever reach users’ inboxes;
• check messages before clicking the unsubscribe button – if you’ve opened an email that’s spam or looks promotional, inspect it a little before clicking any link; if in doubt, turn to the IT support company you work with.

According to Wikipedia (Romanian edition): “Spamming is a very cheap way to advertise something on the Internet; the success of a campaign is usually proportional to the number of recipients, which is why the message is sent to thousands or even millions of addresses at the same time.

Unsolicited electronic messages received by a company can make up more than 60% of all emails. As a result, spam costs storage space on email servers, extra internal traffic to deliver it to employees, and recipients’ working time. On average, each user can lose as much as 50 minutes a day checking, sorting and deleting unsolicited messages. Global losses caused by spam are thus estimated at $81.2 billion a year.

In Romania, where there are more than 13 million Internet users, the damage caused by spam amounts to about $270 million a year, according to data provided by the Ministry of Communications and Information Technology.”

The figures in the quote are older, but the problem remains: spam still means lost time, wasted server space and a security risk for any company.

Where can you unsubscribe safely?

You can safely unsubscribe only from messages sent by companies you know and that you subscribed to yourself, such as online store newsletters. For messages from unknown senders, don’t click any link: mark them as spam and delete them.

A few simple rules:

1. Use your email app’s unsubscribe option, only for known senders. For many promotional messages, Gmail and Outlook show an unsubscribe option next to the sender’s name, which sends the request without opening an unknown page. Since February 2024, Google and Yahoo have required senders who send large volumes of messages to allow one-click unsubscribe.
2. Mark spam as spam. Don’t just delete it: your app’s filter learns from these labels and stops similar messages.
3. Don’t reply and don’t download attachments from messages sent by unknown senders.
4. Use a separate address for website accounts, contests and newsletters, not your work address.
5. If a legitimate company keeps writing to you after you unsubscribe, you can ask it to delete your data, and if it doesn’t respond, you can file a complaint with ANSPDCP (the Romanian data protection authority).

What can a company do about spam?

A company can greatly reduce spam with an antispam filter on the email server, correct rules for its own domain and employees who know what to report. Specifically:

• filtering messages before they reach employees’ mailboxes, in Microsoft 365, in Google Workspace or on the company’s own server;
• SPF, DKIM and DMARC records for the company’s domain, which prevent attackers from sending messages on behalf of your domain;
• a simple reporting procedure: the employee forwards the suspicious message to the IT team, which blocks it for the whole company;
• regular employee training, with real examples.

We can help you with these protections through our IT security services, and a free IT audit shows you how your company’s email is protected right now.

RezolvIT is an IT outsourcing company that supports the companies it works with, whether it’s securing laptops used at home or employees working remotely.