Is it safe to click unsubscribe in spam emails?

The unsubscribe link sits at the bottom of nearly every marketing email, and most of the time it does exactly what it says. The trouble is that spam and phishing emails have unsubscribe links too, and those don't work for you. This guide explains how to tell the difference, how the built-in buttons in Gmail and Outlook keep you safer, and what to do with mail you never asked for.

Is it safe to click unsubscribe?

It depends on who sent the email, not on how the link looks.

The rule of thumb: if you recognize the sender and remember giving them your address, unsubscribing is the right move. If you don't, the unsubscribe link is just another link from a stranger.

Why unsubscribing from legitimate senders is safe

Real businesses have every reason to honor your request. In the US, the FTC's CAN-SPAM compliance guide says commercial senders:

• "must be able to process opt-out requests for at least 30 days after you send your message"
• "must honor a recipient's opt-out request within 10 business days"
• "can't charge a fee, require the recipient to give you any personally identifying information beyond an email address", or make you do more than reply to an email or visit a single page
• can't sell or transfer your address after you opt out, except to a company helping them comply

Mailbox providers add their own pressure. Google requires bulk senders to support one-click unsubscribe for marketing mail, and senders who ignore unsubscribes collect spam complaints that hurt their delivery. Our guide to one-click unsubscribe covers those rules from the sender's side.

So for a store or newsletter you signed up with, unsubscribing works, and it's better than marking the mail as spam. A spam report on mail you actually subscribed to hurts a legitimate sender and doesn't take you off the list.

Why unsubscribing from spam is risky

Spammers don't follow CAN-SPAM, so the unsubscribe link in their mail works for them, not you. There are three risks.

1. It confirms your address is live

Spam is sent to huge lists of bought, harvested and guessed addresses, and many of them are dead. Any response tells the sender that yours reaches a real person who reads their mail. The FBI's Oregon field office put it bluntly in a May 2021 Tech Tuesday warning: "By clicking 'unsubscribe' links or texting 'stop' in reply, the spammers literally take that to mean 'subscribe'". Its advice: "if you get a suspicious email, mark it as spam and delete it without opening it."

A confirmed address is worth more. It can be mailed again, sold on, or added to lists used for more targeted scams.

2. The link can lead to phishing or malware

In a malicious email, the unsubscribe link is controlled by the attacker like every other link. It can open a fake sign-in page ("Sign in to manage your preferences"), a form that asks for personal details, or a page that tries to download a file. Phishing messages sometimes add an unsubscribe line precisely because it makes them look like routine marketing.

A real unsubscribe page should never ask for your password. If one does, close it. If you already typed a password, follow our guide on what to do after clicking a phishing link.

3. It doesn't work anyway

Even when nothing bad happens, unsubscribing from spam rarely reduces it. The sender didn't get your address with permission and has no reason to stop.

How to tell which kind of email you have

Before you click anything at the bottom of a message, run through three quick checks:

• Do you recognize the brand, and did you give them this address? A store you bought from last year counts. A "partner offer" from a company you've never heard of doesn't.
• Does the sender address match the brand? A newsletter from a known retailer should come from that retailer's domain or its mailing service, not a random free webmail account. Our guide to how to spot a phishing email shows how to check.
• Is it in your spam folder already? If your provider has already judged it as spam, trust that verdict and leave the links alone.

How do Gmail's and Outlook's unsubscribe buttons help?

Mail apps can offer their own Unsubscribe button, separate from the link in the email body. It's built from the List-Unsubscribe header a legitimate sender adds to the message. There are two good reasons to prefer it.

The provider checks the sender first. Google's sender guidelines FAQ says: "To protect Gmail users, unsubscribe buttons or links are displayed at the top of messages (next to the sender name) only for messages that pass Google's automated eligibility checks." Messages must meet Google's sender requirements to get the button.

You may never visit the sender's website. With one-click unsubscribe, defined in RFC 8058, the mail provider sends the unsubscribe request to the sender's server directly. RFC 8058 also requires the message to carry a valid DKIM signature covering the unsubscribe headers, and says a receiver "SHOULD NOT offer a one-click unsubscribe" if that signature is missing. That makes the button much harder for a spammer to fake than a link in the body.

Using the built-in tools

1. Gmail: open the message and click Unsubscribe next to the sender's name when it appears. Gmail also has a Manage subscriptions view, under More in the left menu. Google's help page says some senders send you to their own site to finish, and the pop-up then offers Go to website or Block instead. It also notes senders may take a few days to process the request.
2. Outlook.com: go to Settings > Mail > Subscriptions and select Unsubscribe next to the sender. Microsoft's help says the option may not appear for messages already filtered into junk, for blocked senders, or when the message isn't from the same sender as the subscription.
3. If there's no button, that's information too. Either the sender doesn't meet the provider's checks, or the mail was already judged as junk. For an unknown sender, that's a reason to report it rather than hunt for a link.

What should you do with real spam instead?

The FTC's spam advice lists the better options:

1. Mark it as spam or junk. "Most email services include options to mark messages as spam or junk." It moves the message and helps your filter learn.
2. Report phishing as phishing. If the email pretends to be a bank, a supplier or your IT team, use your mail app's phishing report option instead of the junk button. Our guide to reporting phishing emails covers where else to send it.
3. Block the sender if the same address keeps returning. The FTC suggests "blocking specific email addresses or email domains". In Gmail, blocked senders' future messages go to Spam. Spammers change addresses often, so blocking helps most with persistent senders.
4. Delete it. Don't reply, don't forward it to colleagues, and don't click anything.
5. Check your spam folder now and then. The FTC notes "Filters aren't perfect", and real mail sometimes lands there.

What can a business do about spam to its staff?

Individual users shouldn't have to judge every unsubscribe link. A few changes reduce how often they need to:

• Filter before the inbox. An inbound filter at the MX level stops most spam and phishing before it reaches anyone, and holds borderline mail for review. With iBlockSpam, each user gets a personal quarantine with digest emails, so they can release real newsletters and leave the rest.
• Block persistent senders centrally. Domain-wide allow and block lists save each person blocking the same sender.
• Protect published addresses. Addresses on your website attract the most spam. See how to protect public email addresses from spam.
• Turn off catch-all mailboxes. A catch-all address accepts mail for every guessed address at your domain.
• Teach one simple rule: unsubscribe from senders you know, report the rest.

Next steps

• Unsubscribe from newsletters you no longer read using your mail app's Unsubscribe button or subscriptions view.
• Mark outright spam as spam, report phishing as phishing, and don't click links in either.
• If you clicked a spam unsubscribe link and then entered a password, change that password now and turn on MFA.
• If your business is drowning in spam, read how to stop spam for a whole domain, and check your setup with the free Email Health Check.