Am I Wasting My Time Reporting Scam and Spam Emails?

Probably

Yes.

I don’t believe reporting spam to these sites and services is worth the time and effort. I don’t see any harm in doing it; I just don’t think it helps.

I do want to be very clear, however, that a different type of “reporting spam” is very important, and we should all be doing that.

Reporting spam

Mark spam using your email program’s “spam” button. This crowdsourced reporting helps improve spam filters. Forwarding spam to agencies or anti-spam services, however, is ineffective because of modern spam tactics like botnets. While it won’t hurt, it has little impact. Focus on marking spam locally.

The war against spam

Spam is more than an annoyance: it’s a battle. For every step you and I and our email providers take to stop or block spam, spammers come up with new tricks and techniques to bypass those steps. As the recipient of a fair amount of spam — perhaps more than most, since I have several “public” email addresses — I see the magnitude of the problem firsthand.

Related

How Do I Stop Spam?

Spam is inevitable; just don't ask for more.

Reporting spam versus reporting spam

You should definitely report spam using the “spam”, “junk”, or equivalent mechanism in your email program or web interface.

Particularly for web-based email services, our collective feedback is how the system learns what is and is not spam. Think of it as crowdsourcing. This information is collected and used to tune what the email service looks for when deciding something is spam and whether to automatically place it in your spam folder for you.

The more you report spam in this manner, the better the spam filter gets.1

This does nothing to reduce the amount of spam targeting your email address, but the result is that less of it ends up in your inbox, being deflected into your spam folder instead.

Keep doing that. (Just don’t use the “spam” button to unsubscribe from things you asked for; doing so actually hurts other recipients.)

Reporting by submitting or forwarding

The type of spam reporting I feel is useless is that in which you either forward the email to a specific email address or copy/paste the email body or other information into an online submission form.

There’s nothing wrong doing so — it will not harm you or cause you to get more spam — it’s just not going to help you get less.

I’m fairly convinced the addresses you listed2 already get so many reports that whatever you’re reporting is just a drop in the ocean. It would be incredibly rare for you to pass along something that hasn’t already been submitted.

Besides, the nature of spam has changed such that these services simply can’t really work reliably.

Spam sources of the past

In the past, most spam came from specific servers that were owned by or had been compromised by spammers. These servers sent out millions of spam email messages.

That the email came from consistent servers meant it was possible to track them down, and depending on where they were located, shut them down or block them.

That’s when most of these reporting services come into being. By forwarding spam to them, you were helping identify specific sources of large amounts of spam. The services then tracked down the owner, or the owner’s ISP, and had the spammer shut down. If they couldn’t shut them down, they added the IP address of the server to a “black list” which other ISPs then used to block that server.

Unfortunately, this approach is no longer effective.

Why?

Botnets.

Related

Why Doesn’t Blocking Email Senders Work?

Most email programs can block email from a specific address. Unfortunately, that's completely ineffective when it comes to spam.

Spam comes from everywhere

Botnets, created by installing malware on millions of computers worldwide, have replaced individual mail servers for sending spam. Rather than sending 10,000,000 emails from one server, a spammer might now send 100 mails from each of 100,000 infected machines.

Your machine could be one of them, and you might not even realize it. (Make sure your security software is up-to-date and scanning!)

One hundred thousand machines is an impractical number of machines to track down. Even if it could be done, tracking them down wouldn’t help; spammers would just use other infected machines to continue to send out spam.

As a result, the reporting services you’re asking about can’t really help.

We do hear of botnets occasionally being brought down, but identifying the spam emails doesn’t play a role. Instead, the malware that infected machines in the first place must be tracked down and defended against.

Speaking of bots…

A relatively new entry in the “report spam” arena is the ability to forward a copy of spam to a service of some sort that promises to waste the spammers’ time by using a different “bot” to engage them in a fake conversation for as long as possible.

This is another waste. It’s akin to fighting spam with spam — you’re causing the internet to be flooded with even more fake email. You’ve contributed to the problem.

I’m also convinced that the spammers will catch on pretty quickly and recognize the bot for what it is: ineffective and easily ignored.

When reporting spam might help

Before I write off reporting completely, though, I do have to add that some agencies — in particular, the FTC (the U.S. Federal Trade Commission)  — may do more than just track down servers and IP addresses. The FTC may also look at the content of the message and see if what’s being hawked violates federal law. With enough instances of an issue, I would hope they’d go after the merchant.

Unfortunately, they may not do much even then. Many — perhaps even most — of these scams originate overseas, where the FTC has no jurisdiction.

The bottom line: depending on the spam and the service, forwarding spam to these services has only a tiny chance of helping.