Is it safe to open a spam email?

Short answer: yes, opening a spam email is usually safe. Reading a message in an up-to-date mail app almost never harms your device. The risk starts when you click, download, scan, reply or load images. This guide explains what really can happen, what to avoid, and what to do if you've already clicked something.

Is it safe to open a spam email?

Yes, in most cases. Opening and reading a spam email in a modern, updated mail app such as Gmail, Outlook or Apple Mail is low risk. Mail apps show messages in a way that stops most harmful content from running by itself.

What isn't safe is interacting with the email. The FTC warns that scammers "send phishing emails with attachments or links that, if opened or clicked, install harmful malware" (FTC). So opening is fine. Clicking is where problems begin.

Spam means unwanted email sent in bulk, usually ads. Some spam is also phishing: a scam that pretends to be someone you trust to steal passwords, money or personal details. Our guide to the difference between spam and phishing explains how to tell them apart.

What can happen if I open a spam email?

Usually nothing, unless you take a next step. This table shows the real risk of each action.

The rule is simple: the more you do, the higher the risk.

Can opening an email give you a virus?

It's rare, but not impossible. Almost all email malware needs you to open an attachment, enable macros (small programs inside documents) or download something from a link. See our list of dangerous email attachment types for the files to watch out for.

Very rarely, a security bug lets an attacker cause harm without any click. One real example: in 2023 Microsoft described an Outlook for Windows flaw, CVE-2023-23397, where "The user does not need to interact with the message" (Microsoft Security Blog). Microsoft's fix was an Outlook security update, and its advice was to install it "as soon as possible".

That's why the most important protection is boring: keep your mail app, browser and device updated. Updates close holes like this one.

Does opening spam tell the spammer my email address is real?

Sometimes, yes. Many spam emails carry a tracking pixel: a tiny, invisible image. When your mail app downloads it, the sender's server notices. That tells them the email was opened, and that your address is active. Active addresses get more spam.

Your mail app can stop this:

• Outlook (classic, for Windows): Microsoft says Outlook "is configured by default to block automatic picture downloads from the Internet." One reason it gives is to avoid "tracking pixels: invisible images that can tell a sender you've read the email" (Microsoft Support). Leave that setting on.
• Gmail: Google says it scans images "for signs of suspicious content before you receive them", but admits "senders may know whether you've opened an email that has an image." To stop images loading by themselves, go to Settings > See all settings > Images, choose Ask before displaying external images, then Save Changes (Gmail Help).
• Apple Mail on Mac: Choose Mail > Settings > Privacy and select Protect Mail Activity. Apple says that with this on, "your IP address is hidden from senders and remote content is privately downloaded in the background when you receive a message" (Apple Support), so the sender can't tell when you open it.

If you're already getting a flood of junk, our guide to why you get so much spam explains where it comes from.

Is it safe to open spam that looks like it came from my own address?

Yes, it's as safe to open as any other spam, and it usually doesn't mean you were hacked. Email has no built-in proof of who sent it, so a spammer can put your address in the "From" line. This is called spoofing. A common version is the scam that claims to have hacked your device and demands payment; our guide to sextortion scam emails explains why those threats are almost always bluffs.

Don't reply and don't pay. Report it and delete it. If you also see messages in your Sent folder that you didn't write, or friends say they got odd emails from you, that's different: follow someone is sending email from my address to check whether your account was really taken over.

Is it safe to open spam on my phone?

It's about as safe as on a computer, as long as your phone is updated. The bigger risk on a phone is that links are harder to check: you can't hover over them to see where they go, and screens are small. QR codes in emails are a common trick for this reason; see QR code phishing.

On a phone, don't tap links in spam at all. If an email claims to be from your bank or a delivery company, open their official app instead.

Why does spam still get into my inbox?

Because no filter is perfect, and spammers keep changing their tricks to get past them. The FTC says it directly: "Filters aren't perfect, so even emails that make it past the filter might still be spam" (FTC). New sending domains, fresh links and messages that look like ordinary newsletters can all slip through, especially in the first hours of a campaign.

A spam email in your inbox doesn't mean it's safer than one in the spam folder. It only means the filter wasn't sure. Treat it the same way: don't click, report it, delete it.

Reporting is what makes the filter better over time. Google says: "As you report more spam, Gmail identifies similar emails as spam more efficiently" (Gmail Help). In Outlook with a Microsoft 365 work or school account, Microsoft says a message reported with the Report button as junk is moved to the Junk Email folder and the sender is added to your Blocked Senders list (Microsoft Learn). Deleting spam without reporting it teaches the filter nothing.

If the same kind of junk keeps arriving, check your filter settings; our guide to Outlook junk email filter settings shows the options, and how spam filters work explains why some messages land in the gray zone. Gmail vs Outlook spam filtering compares the two providers' controls.

What should I do with a spam email instead?

Report it, block it if it keeps coming, and delete it. You don't need to read it first. Follow this checklist.

1. Don't click anything. No links, buttons, attachments or QR codes.
2. Don't reply. Not even to say "stop".
3. Don't unsubscribe from senders you never signed up with. Our guide on whether it's safe to unsubscribe from spam explains when unsubscribing is fine.
4. Report it. Use Report spam in Gmail or Junk in Outlook and Apple Mail. Gmail says reported emails are "added to Spam" and it uses reports to spot similar emails (Gmail Help). If the email pretends to be a company or person you trust, use Report phishing instead; see how to report a phishing email.
5. Block the sender if the same one keeps getting through.
6. Delete it.
7. Check your spam folder now and then. The FTC says "Filters aren't perfect", so real emails sometimes land there too (FTC).

How do I know if a spam email is actually dangerous?

Look for pressure and requests. CISA lists warning signs such as a sender address that "may imitate a legitimate business", generic greetings, spoofed links and unexpected attachments (CISA). An email that wants you to act fast, sign in, pay or open a file is more dangerous than a plain ad. Our guide to spotting a phishing email walks through ten checks, and how to check if a link is safe shows how to inspect a link without clicking it.

I opened a spam email. What should I do now?

If you only opened it, you don't need to do anything except report and delete it. If you did more, use the step that matches.

1. Only opened it: Report it as spam and delete it. You're fine.
2. Clicked a link but typed nothing: Close the page. Report the email. Run your security software's scan if anything downloaded.
3. Typed a password: Change that password now, from a device you trust, and anywhere else you reused it. Turn on two-step sign-in.
4. Entered card or bank details: Call your bank using the number on your card.
5. Shared personal details like your Social Security number: The FTC says to go to IdentityTheft.gov, which lists steps based on what was lost (FTC).
6. Opened an attachment: Disconnect from the internet and run a full scan. On a work device, tell IT straight away.

For steps 3 to 6, follow our full guide on what to do after clicking a phishing link.

How can a business keep spam out of inboxes?

For a business, the safest spam is the spam staff never see. Filtering at the edge of your email, before messages reach mailboxes, removes most junk and phishing so nobody has to decide whether to open it. Suspect messages wait in a quarantine that each person can review, instead of mixing with real mail. If you run email for a small team, our page for small businesses explains how iBlockSpam filters inbound mail for Microsoft 365, Google Workspace and other mail servers.

Next steps

1. Keep your mail app, browser and phone updated.
2. Turn off automatic image loading in Gmail, or turn on Protect Mail Activity in Apple Mail.
3. Report spam with your mail app's button instead of clicking anything in it.
4. If you clicked something, follow the steps in what to do after clicking a phishing link.
5. If your team gets too much spam, see how iBlockSpam helps small businesses.