Fake Unsubscribe Link Scams

Fake unsubscribe link scams exploit a deeply conditioned behaviour: clicking the unsubscribe link in an unwanted email. Legitimate marketers are required by law in many countries to include a functional unsubscribe mechanism in commercial emails. This means consumers are trained to use unsubscribe links as a routine response to unwanted messages.

Fraudsters embed unsubscribe links in spam and scam emails that, rather than removing you from a mailing list, perform one or more harmful actions: they confirm to the sender that your email address is active and monitored, greatly increasing its value in the spam economy; they redirect to a phishing page that captures your email credentials or asks you to 'confirm' your email and password to complete the unsubscription; they trigger a download of malicious software onto your device; or they redirect to an advertising page that generates revenue for the sender by recording the click.

In some cases, clicking an unsubscribe link is the primary mechanism through which a spam campaign harvests confirmed active addresses. A mass spam send followed by a request to 'click here to unsubscribe' can convert a raw list of email addresses — many of which may be inactive — into a refined list of active, monitored accounts, which are worth significantly more to other spammers and fraudsters.

This scam is distinct from legitimate unsubscribe processes. The distinguishing features are: the original email was unsolicited and from an unknown sender; the unsubscribe page asks for credentials or additional information; or the email is clearly commercial spam of a suspicious nature.

You receive an email that appears to be commercial marketing but from a sender you do not recognise. The email contains an unsubscribe link at the bottom, as legitimate commercial emails do. Your natural response is to click it to stop receiving similar messages.

Clickin the link sends a request to a server controlled by the spammer, recording your email address as active. In some implementations, the link opens a page that asks you to 'confirm your email address' to complete unsubscription — obtaining your typed confirmation that the address is active.

In the phishing variant, the unsubscribe page is designed to look like an email provider login screen. It claims your subscription cannot be managed without verifying your identity, and asks for your email address and password. These credentials are captured and used to access your email account.

In the malware variant, clicking the link triggers a download — sometimes disguised as a browser plugin or PDF — that installs software on your device.

After the click, rather than receiving fewer emails, you typically receive significantly more, because your address has been added to additional lists as a confirmed active account.

The unsubscribe convention is one of the most reliable behavioural triggers in email. It is required in genuine commercial email, widely used, and strongly associated with taking control of an unwanted situation. Fraudsters insert themselves into this conditioned behaviour precisely because victims are acting habitually rather than evaluating each individual link.

You are receiving this email because you subscribed to [vague service]. To unsubscribe, click here: [link].

To stop receiving these emails, confirm your email address at [link]. Enter your email and password to remove yourself.

Manage your preferences at [link]. Enter your credentials to update your subscription settings.

Click to unsubscribe: [link]. Note: you must verify your identity to complete the unsubscription process.

Before clicking any unsubscribe link, ask one question: did I ever sign up for communications from this sender? If the answer is no, use the spam or junk report function in your email client instead. This achieves the same result — stopping future messages — without confirming to the sender that your address is active.