How spammers do it, and what steps you can take.
Spammers do everything they can to get their garbage in front of you, and that means using and abusing every tool at their disposal.
One of those tools is also available to you and me when we send email.
Getting spam not addressed to you
You were BCC’ed. The BCC (blind carbon copy) feature allows email to be sent without displaying the recipient’s email address. Spammers use this to hide some or all of the actual recipients of a spam email message. As a result, you may receive spam email in which your email address doesn’t appear. Since it’s spam, mark it as such and move on.
The BCC field
Blind Carbon Copy1 is a technique to send an email without the recipient’s name or email address appearing in the message. You might use the BCC field when emailing a group of people so you don’t share their email addresses without permission.
In addition to the To: and Cc: fields, email programs typically include a Bcc: field. Here’s an example2:
You can add email addresses to any of these fields.
- To: is used for one or more direct recipients of the message.
- Cc: is used for one or more recipients who also get the message. While the message isn’t directed at them, they also receive it. Often, people use this as an FYI so others can see the message. Any Cc: recipients are displayed in the message on the Cc: line.
- Bcc: is used for one or more recipients who get the message. This is exactly like Cc:, except that the list of people receiving the message via Bcc isn’t included in the message when it is sent.
Related
How Do I View the BCC Recipients on an Email I’ve Received?
BCC is a way to send copies of email without all recipients being visible. But can you still view the BCC'ed?#11352
Who else was BCC’ed?
There’s no way for a recipient to tell who was BCC’ed, how many were BCC’ed, or even if any Bcc: addresses were used when a message was sent. (There are ways you can see the BCC’ed recipients on a message you’ve sent.)
Spammers use this technique to send one message to hundreds of people at once. Listing all those addresses as Cc: or To: would make the message more likely to be flagged as spam. Since you can’t tell that Bcc: was used, you have no idea that hundreds of others might be getting the same message.
As just one example, those hundreds of messages might be what’s called a dictionary attack. Spammers try variations on email names in the hope that one or more will reach a real person. For example, they might3 try “leo@”, “leoa@”, “leob@”, and the like on any of my domains. Some might work and some might not, but there’s no added cost to the spammer to try ’em all. Most will be hidden in the Bcc: line you can’t see.
The To: line
What using the BCC line does is allow the spammer to ignore, or overload, the To: line with email addresses that are unrelated to yours. They can be similar — for example, I might get leon@askleo.com, leonot@askleo.com, leonora@askleo.com, and so on. leo@askleo.com is nowhere to be seen.
You’ll get it because you were BCC’d. The To: line is actually irrelevant. I’d get my example because leo@askleo.com was BCC’d.
Why do spammers do this? It’s hard to say. It might be a case of wanting the To: line to look official enough that you don’t think twice about opening the email. Or it might be to fool the spam filters into letting the message through. Or it might be something else.
Do this
There’s nothing you can do about this specific situation other than treat the message as spam. Mark the message as spam if it’s landed in your inbox. Your spam filter will use other factors and characteristics of the message to update its database of what you (and perhaps others) consider spam. Mark these messages as spam enough times, and they should get routed to your spam folder automatically.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Footnotes & References
1: Some apparently know it as “Courtesy Copy”. “Carbon Copy” harkens back to the days of using carbon paper to automatically make copies as documents were typed on a typewriter. Look it up, kids. 
2: Not all email programs or interfaces show the Bcc line by default. You may need to click on an option or other user interface control to display it.
3: There is no “try”. They definitely “do”.
Leo, you wrote:
“Carbon Copy” harkens back to the days of using carbon paper to automatically make copies as documents were typed in a typewriter. Look it up, kids.”
I’ve actually used carbon paper, back in the day. And, who you callin’ a “kid” ??? 🙂
“Kids” wouldn’t have know what it is, much less used it. (As did I, by the way.)
I used to teach my students how to write emails and had to explain what carbon paper was. I few had actually seen carbon paper as some receipt books still cam with carbon paper inserts.
To: and CC: are functionally identical. The only difference is that the person receiving the email gets a notification line in the email that they’ve been CC’ed.
In the text book there was a warning about CC’s.
An American company sent an email to a client, in a country I won’t mention here, and CC’ed their supervisor. The supervisor was offended because it’s poor form to relegate the boss to CC status in that culture.
To which I’d say… suck it up. Really, in this day and age the planet has gotten much, much smaller. My wife comes from a country that “would have” had that sort of attitude. But they’ve had to adapt to the internationalisation of communications, including information going from the top of the organisation to those at the bottom.
I agree, but when you are dealing with a client, it’s usually best not to offend them even if they are wrong.
I occasionally use BCC when I do not want the original “TO” or “CC” recipients to know the email was sent to a particular person. I know BCC recipients do not see the addresses of other BCC recipients, but will BCC recipients see any of the “TO” or “CC” addresses?
YES. ALL recipients see the To: and Cc: lines.
Why do I receive spam mail address to me but not the email provider I use example my email is
Emailaddress @ Gmail.com but the mail the spam was sent to says Emailaddress @ aol.com
That’s just how spammers work. It’s an attempt to fool you into opening the mail to examine its contents.
This is good information. Thanks!
Is there a way to block emails entering your inbox by blocking the email in the “sent to” box and not the “from box”? I all of a sudden started receiving multiple spam emails . See below
For example my email is
Emailaddress @ Gmail.com but the mail the spam was sent to says that the receiver (myself)
was a version of these emails below…
E.mailaddress @ Gmail.com
Em.ailaddress @ Gmail.com
Ema.iladdress @ Gmail.com
Email.address @ Gmail.com
Emailaddress @ aol.com
Is there a way I can block the incoming email so that I only receive emails that are sent to
Emailaddress @ Gmail.com
and block all of the other email addresses?
Not that I’m aware of. You could play with Gmail filters, but the problem is that to Gmail those are all the same email address (it ignores the periods).
Leo, that’s the same problem I have. I get 10 emails a day that are spam. When I block one, they just change the email address and I get another, some multiple emails addressed to me at different addresses. For example, if my real address is {email address removed}, I get email delivered that read {email address removed}. When I block it, the next one comes to {email address removed}. These are just examples, but I can’t find a way to stop it. I wish there was a way to block all email that does not come to my real address.
Your “real” address IS getting the email, it’s just being BCCed. Anything that accomplished what you want would also break the ability for legitimate uses of BCC.