Highlighted wordsare glossary terms — tap one for a plain-language definition.
That junk email sitting in your inbox feels harmless — and it is, as long as you leave it alone. The moment you reply, even just to say 'unsubscribe,' you tell the spammer something they care about: your address is real, someone reads it, and it's worth selling. [1, 2]
The reply that costs you
Microsoft's spam guidance is blunt: never reply to a spam message — not even to unsubscribe from a mailing list — unless you know and trust the sender. Answering spam confirms your email address is an active one, and active addresses are valuable. Spammers verify replies, then sell the confirmed list to other spammers, which is why one reply can turn a trickle of junk into a flood. [1]
- Never reply to spam — not even to unsubscribe or ask to be removed.
- A reply proves a human reads that inbox, making it worth more to sell.
- Real newsletters you signed up for are the only exception — unsubscribe through their genuine links or settings.
Signals you send without typing
You don't have to write back to give yourself away. Spam messages often load images from the sender's server — invisible 'web beacons' that report your address as live the moment the picture downloads. Responding to a spammer's meeting request or sending a read receipt confirms your address the same way. That's why email apps block remote images and receipts by default, and why you should leave them blocked for mail you don't trust. [1]
- Loading a spam email's images can verify your address — keep remote content blocked for unknown senders.
- Decline meeting requests and read receipts from people you don't know.
- Preview mail in the list, and only open messages you were expecting.
Why replying is risky
A reply doesn't just confirm your address — it opens a conversation with someone trying to take your money or identity. Microsoft warns that most legitimate companies will not ask you to send Personal informationWhat it means: Information that identifies or can be connected to a person.Example: Your full name together with your birthdate and home address.What to do: Share only the minimum a form actually requires.Important: Small details combined are enough for identity theft.What does this mean? by email, so a message asking you to reply with account details is a red flag for PhishingWhat it means: A deceptive email or message designed to make you click, share information, send money, or give account access.Example: An “unpaid delivery fee” text with a link to a page that looks like the post office.What to do: Don't tap links in unexpected messages — open the company's app or type its address yourself.Important: Real companies never ask for your password or a login code by message.What does this mean?, not a real VerificationWhat it means: Confirming a request through a separate, trusted method.Example: Calling the number on the back of your card instead of the one in the message.What to do: Save official phone numbers and app logins now, before you need them.Important: Never verify using contact details supplied in the suspicious message itself.What does this mean? step. And the FTC is clear that legitimate companies never ask for passwords, PINs, or account numbers by email or text. Once you reply, the scammer can escalate: more convincing follow-ups, phone calls referencing 'your exchange,' and pressure to act before you think. [1, 2, 3]
- Never send passwords, PINs, or account numbers by email — no real company asks.
- Every reply teaches the scammer what works on you and invites the next move.
- An urgent reply request is pressure, not proof.
What to do instead
The safe path takes less effort than replying: use your email app's 'Report' or 'Report phishing' option, or mark the message as junk and block the sender — this helps filters protect you and everyone else. Don't click links or open attachments, and don't call any phone number in the message. If the message claims to be from a company you actually do business with, contact it yourself using a number you find on your statement, its app, or its official website. Suspect a scam? Report it at ReportFraud.ftc.gov. [1, 2, 3]
- Report junk or phishing in your email app, then delete the message.
- Verify companies through a number you find yourself — never one from the email.
- Report scams at ReportFraud.ftc.gov to protect the next person.
Why Hygi. recommends this — the guidance above follows these published sources:
Microsoft
10 tips on how to help reduce spam(opens in a new tab)Never reply to spam — not even to unsubscribe; replies, image beacons, and read receipts all confirm your address is active.
Microsoft
Protect yourself from phishing(opens in a new tab)Phishing works by getting you to respond or click; pause, examine the sender, and never share personal information in a reply.
FTC
How To Recognize and Avoid Phishing Scams(opens in a new tab)Legitimate companies never ask for passwords, PINs, or account numbers by email or text; report phishing instead of responding.
Brought to you by NorthBridge
Unfamiliar term? Open the Digital Safety Glossary