Technology in terms you understand. Sign up for my weekly newsletter, "Confident Computing", for more solutions you can use to make your life easier. Click here.

Why do I get spam that’s not addressed to me?

//
Why do I receive junk emails that are not addressed to my specific email address but to several subtle variations of my address? Why do these emails get delivered to my address when they are not addressed specifically to me? And how should I most properly dispose of them?

Spammers do everything they can to get their garbage in front of you, and that means using and abusing every tool at their disposal.

One of those tools is something that’s available to you and me when we send messages as well.

Become a Patron of Ask Leo! and go ad-free!

BCC

You were BCC’ed on the spam.

“BCC” stands for Blind Carbon Copy1 and it’s a technique to send someone an email without their email address appearing on the message.

Typically, email programs have, in addition to the To: and Cc: fields, a Bcc: field that can be filled in as well. Here’s an example in Thunderbird:

Thunderbird Addressing Dropdown

You can see that Thunderbird allows you to specify Bcc: as one of the addressing options.

In short:

  • To: is one or more direct recipients for the message.
  • Cc: is one or more recipients who also get the message. While the message is not directed at them, they also receive it. Often, people use this as an FYI to others to see the message. Any Cc: recipients are displayed in the message on the Cc: line.
  • Bcc: is one or more recipients who also get the message. This is exactly like Cc: except that the list of people receiving the message via Bcc is not included in the message when it is sent. Upon receipt, there’s no way to tell who, how many, or even if any Bcc: addresses were used when the message was sent.

Because this comes up time and time again, let me be clear:

Upon receipt, there’s no way to tell who, how many, or even if any Bcc: addresses were used when a message was sent.

Spammers use this technique to send one message to perhaps hundreds of people at a time because actually listing all of those addresses as Cc: or To: makes the message more likely to be flagged as spam. Because there’s no way to tell when you get the message that Bcc: was used, the fact that hundreds of others might be getting the same message can’t factor in to figuring out whether or not it’s spam.

MailboxesAnd those hundreds of messages might well be what’s called a dictionary attack, meaning that they just try variations on email names with the hope that one or more will actually reach a real person. For example, they might try “leo@”, “leoa@”, “leob@”, and so on, on any of my domains. Some might work, some might not, but there’s no added cost to the spammer to try ’em all. Most might well be hidden in the Bcc: that you can’t see.

Ultimately, there’s nothing you can really do specifically about this situation. Flag it as spam, if your email program supports that, and other factors and characteristics of the message will likely be added to the database of what looks like spam to you. Maybe the next one will get flagged automatically.

Footnotes & references

1: Some apparently know it as “Courtesy Copy”. “Carbon Copy” harkens back to the days of using carbon paper to automatically make copies as documents were typed in a typewriter. Look it up, kids. 🙂

16 comments on “Why do I get spam that’s not addressed to me?”

  1. Although everything that was discussed is very interesting, I don’t believe that the question was answered.

    I don’t claim to know the exact answer to the question but, for example, I do know that gmail has this feature that if your email address is:

    myEmail@gmail.com

    you might type my.Email@gmail.com and for gmail both addresses are the same one. It can even go as far as being myEmail+someSite@gmail.com and gmail will still consider it to be the same address which is usefull since if one day you receive an email from an unknown source with this email address, you’ll know that “someSite” sold its emails database.

  2. I have to agree with the above; I’m not sure the question was answered. I know of a couple of reasons that might produce the situation described, for instance, if the e-mail recipient happens to own the domain and their e-mail address is the “catch all” address for the domain.

    Also, spammers can fake most of the header information in their e-mails. I’d advise the questioner to check the “Envelope-to:” and “To:” lines in the e-mail’s header.

  3. Not exactly the question raised here but perhaps a related issue….

    Not so much recently but in the past I received numerous crap emails seemingly addressed *from* me. (If my email address is, for example, abc@xyz.com the email would not only be addressed *to* that address but *from* that same address.)

    Concerned at first thinking someone was sending spam from my hijacked email address after some time I ceased being worried and simply figured the spam-sender’s program somehow simply did this by design — perhaps further enticing the recipient to open the email (after all, it was sent from me!).

    BTW – Either HTML tags on these boards don’t work for me or the effects of using them don’t show in the “Preview” window. I’m not sure which.

  4. When I first used hotmail, I got hundreds of spam,phishing, and plain con e-mails [ including money scams ] then I loaded the ACMA submission page in my favorites.Every time I got crap – I passed the whole page to ACMA [ located in Canberra ] Their job is to track these scum, arrest them and prosecute. It’s been over a year now and I don’t get any spam EVER!!!. And I don’t even run any anti-spam programs; I guess when the federal police start knocking on doors, some people get the message 🙂

  5. I’m confused. The answer does not match my experience. When I get one of these spam messages…there is nothing in the headers to indicate that the message is meant for my account. However, when people BCC me…there are headers in the message to indicate that the message is meant for my account. So I still do not understand how I keep getting spam email in my account when no header in the message indicates that it is for my account?

  6. I read this article and also followed the link to “Why shouldn’t I use the “Report Spam” or “Junk” button?” I have been getting emails every day from a source that I KNOW I have not subscribed to. Perhaps I could open these and look for an unsubscribe option, or perhaps I could open these and find I am now infected with a virus. I choose to not open these and add to my Blocked Sender List and Bounce Back To Sender. It does not appear to do any good, but makes me feel better. What say you?

  7. My span list has grown massively since I started using Facebook and I find my posts being reposted on other site pages. Can I sue FB??

    I’m guessing not, that the terms you agreed to when creating your facebook account gave them permission to do whatever, but I am no lawyer and I can’t hand out legal advice.

    Leo
    14-Dec-2011

  8. Not particularly related to this question – Why is there a tab “Free Newsletter” sticking out and obscuring part of your news letter? (I have increased the web page to make it easier for me to read it!) I already receive your news letter!

    The website has no way to reliably tell that you are a newsletter subscriber. That tab moves out of the way automatically in IE9, Firefox and Chrome (and perhaps others). I’m working on a solution for IE8.

    Leo
    17-Dec-2011
  9. Tom,

    I had the same problem until I learned this trick.

    When you add an address to the Blocked Senders list, do not include anything before the @ symbol. Frequently that stuff keeps changing, but what follows remains fairly constant.

    As an example, Me@mysite.com would be blocked simply as @mysite.com. That will block everything from mysite.com even if they change the “Me” portion.

  10. alpha omega,

    I frequently BCC myself on business e-mail I send out so I’ll see exactly what the recipient(s) see. Also, it will be in my Inbox where it is easier to find.

    I just checked the source code for some I received from myself, and there was no BCC listed; only the From, To and CC. This was true of two e-mail clients.

    Perhaps those you see as being sent to you are CC instead of BCC.

  11. Leo,
    When I get a doubtful email, I view the full header to know its origin and if from like serbia, vietnam etc I just delete it. In Gmail unless I open the mail I cannot see the full header, unlike in Yahoo mail. Suppose if I forward it to my Yahoo mail and check the full header, will the sender know I have opened his mail/spam ? I get very minimal spam and doubtful ones are extremely rare.

  12. I received an email from an alleged Russian woman writing from a gmail account, but directed to an unfamiliar hotmail address. Even though the email was directed to an unfamiliar email address “unfamiliarname@hotmail.com”, I received it in my junk mail box. Maybe I was bcc’d in that email and it is a spam, but is it possible that my email account has been hacked?

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.