How to stop spam emails: what works, what backfires

Most of what people call spam is one of two things, and treating them the same is where advice goes wrong.

• Marketing you did sign up for, at some point: shops, newsletters, apps, the airline you flew once. These senders are real companies, they are covered by US law, and unsubscribing works.
• Junk from strangers: fake invoices, prize notices, "your account will be closed", offers from companies you have never heard of. These ignore the law. Clicking anything in them, including an unsubscribe link, confirms your address is live and can take you to a phishing page.

The FTC's advice on unwanted email makes the link to security explicit: fewer unwanted emails means fewer chances to click a phishing link.

The CAN-SPAM Act requires commercial email to include a working way to opt out, to honor opt-outs within 10 business days, to keep the opt-out working for at least 30 days after sending, and not to charge a fee or ask for more than your email address. So for senders you recognize:

• Use your email app's own unsubscribe button where it appears near the sender's name. It sends the request without you visiting the sender's site. Google requires bulk senders to Gmail to support this one-click unsubscribe (Google's sender guidelines).
• In Gmail, open Manage subscriptions from the left-hand menu. Google introduced it in 2025; it lists the senders who email you most and unsubscribes in one click (Google Workspace update).
• Otherwise, use the link at the bottom of an email from a company you clearly recognize. If a page asks for your password or anything besides your email address, close it.

Gmail, Outlook.com, Yahoo and iCloud all filter spam by default. The filter learns from you, so:

• Mark junk as spam rather than deleting it. Deleting teaches the filter nothing.
• Mark good mail as "not spam" when it lands in the junk folder, so you do not miss a bank notice or a delivery update.
• Block a sender who keeps coming back from the same address.
• Check your junk folder once a week for a few weeks while the filter adjusts.

Phishing that gets past the filter needs a different response; see how to spot phishing emails and report it to your provider. Scams can be reported to the FTC at ReportFraud.ftc.gov.

Spam comes from the places your address has been: every shop, app and contest you have signed up with, plus every one of those that has been breached or sold its list. You cannot pull your address back out of those lists, but you can stop adding it to new ones.

An email alias is a separate address that forwards to your inbox. Give each site its own, and if one starts getting spam you know who leaked it and can switch that alias off without touching anything else. Apple's Hide My Email (with iCloud+), Firefox Relay, Proton Pass and Fastmail's masked email all do this.

If your current address is buried in years of spam, you can also move to a fresh one, give it only to people and companies you trust, and use aliases for everything else. Our guide to private email providers compares where to go.

Sometimes the inbox is not full of spam so much as legitimate but unimportant mail: receipts, notifications, newsletters you half want. Filtering services sort those out of the way automatically. They are inbox triage, not security: they do not catch phishing or malware better than your provider does.

SaneBox is one of these. It works with Gmail, Microsoft 365, iCloud, Yahoo, Fastmail and any IMAP account, moves low-priority mail into a separate folder with a daily digest, and has a "BlackHole" folder that stops a sender reaching your inbox again. SaneBox says it reads only the sender, subject and date and never stores full emails or attachments. It does need access to your mailbox, which some people will not want to give any third party.

• Do not reply to spam, even to say stop. It confirms a real person reads the address.
• Do not open attachments or call phone numbers in unexpected email.
• Do not pay for "spam removal" services that promise to delete your address from the internet.
• Do not assume a big spam spike means you were hacked. It usually means your address leaked from a company. Check it in a breach checker and change any reused passwords.