How Does Spam Work?

Learn what spam is, how it works, and what you can do to stop receiving unwanted emails.

Spam is Internet slang for unsolicited email, primarily unsolicited commercial email (UCE). The use of the term "spam" (a trademarked Hormel meat product) is supposedly derived from a Monty Python sketch in which Spam is included in every dish offered at a restaurant.

Recipients of spam often consider it an unwanted intrusion in their mailbox. Internet Service Providers (ISPs), such as America Online, consider spam to be a financial drain and an impediment to Internet access because it can clog an ISP's available bandwidth. Spam has also been linked with fraudulent business schemes, chain letters, and offensive sexual and political messages.

Not all bulk email is spam. Some is permission-based, meaning that the recipient has asked to receive it. This occurs when a user at a website voluntarily agrees -- for example, at the time of making a purchase -- to receive a newsletter or other email (known as "opt-in email"). Unlike spam, opt-in email usually provides a benefit such as free information or sale prices. Sending unsolicited email to online customers who have not elected to receive information is considered spam. Since most legitimate businesses recognize the public's strong anti-spam sentiment, they avoid using it. 

How Spam Works

Spam is rarely sent directly by a company advertising itself. It's usually sent by a "spammer," a company in the business of distributing unsolicited email. An advertiser enters into an agreement with a spammer, who generates email advertisements to a group of unsuspecting recipients. The cost of spam is far less than postal bulk mailings. An advertiser could spam 10,000 recipients for under $100 versus several thousand dollars for a postal mailing.

How do spammers find you? Sometimes they may buy your address -- 15 million email addresses can be purchased for as little as $129 -- or they obtain them by using software programs known as "harvesters" that pluck names from websites, newsgroups, or other services in which users identify themselves by email address.

To protect against harvesters of email addresses, some websites use software that "poisons" the harvester -- for example, generating bogus email addresses or directing the harvester to a nonexistent site. The use of poisoners, filters, and blocking software can be costly and creates an escalating cat and mouse game as spammers attempt to circumvent each new round of anti-spam software.

The Problem With Spamming

Defenders of spam claim that it is little different from junk mail and can, in fact, be tossed more easily: simply hit the delete key. Although there is some truth to this position, receiving spam is actually more like receiving a junk fax or a sales call on a cellular phone because the cost of distributing the advertisement is borne by the recipient (or the recipient's ISP), not the sender. (The annual cost of spam to U.S. corporations is currently $9 to $10 billion a year.)

Every ISP pays for the right to operate on the Net by purchasing bandwidth, the "space" it uses to transmit over the Internet. As the volume of spam directed through an ISP increases, the bandwidth becomes crowded, often slowing down the user's Internet access. To counter this, the ISP must pay for filtering software (which can also slow access) or pay to increase the amount of bandwidth. In both cases the expense is often passed along to subscribers. To get an idea of how much bandwidth is consumed by spam, America Online estimated that one-third of the 30 million daily email messages it transfers is spam.

You've probably noticed that much of the spam you receive involves deceptive practices. For example, spam for X-rated sites may be disguised with a personal subject header ("How come you didn't write back?" or "Here's my new email address") or even as anti-spam ("We can help remove you from spam lists!"). And you've no doubt noticed that a lot of the spam that comes your way is attempting to perpetuate some sort of scam -- pyramid schemes, bogus stock offerings, pirated software, and quack health remedies.

Some spam allows you to request that your email address be removed from the spammer's list, but consumer groups caution that when you respond to a spam email, you verify to the sender that your email account is active. This may result in your receiving even more spam. A 2002 Federal Trade Commission (FTC) study found that more than half the time, responding to a “remove me” option resulted in either no change or more spam.

The War Against Spam

In 2003, the U.S. Congress passed legislation known as the CAN-SPAM Act (15 USC § 7701 and following). The Act regulates unsolicited commercial email messages and requires that they include a notice that the message is an advertisement or solicitation. It also requires that such messages include the sender's valid postal address and a means for the recipient to opt-out. The Act prohibits deceptive subject headings, and it requires that email containing sexually oriented material contain a warning label. It also creates criminal or civil penalties for sending spam through another's computer without authorization, and for sending deceptive unsolicited commercial email.

The Act also authorizes the FTC to create a “Do-Not-Spam” registry. But in June 2004, the FTC concluded that such a registry would not be effective at present because spammers would use it as a “do spam” list.

Before the federal CAN-SPAM Act was enacted, some 35 states had enacted anti-spam legislation. The Act supersedes state laws that expressly regulate the use of email to send commercial messages, except to the extent that they prohibit falsity or deception in the message or an attachment. The Act may be enforced by the FTC, state attorneys general, and ISPs.