By Jewel Rana and Farid Ahmmad · Published November 13, 2026
You have been careful with your email address, and the spam arrives anyway. It can feel random, but there are only a handful of routes an address takes to reach a spam list. Knowing them helps you work out which one applies to you and close it.
1. A data breach
This is the most common source. When a website you signed up to is hacked, its user list is stolen and traded, often for years afterwards. You did nothing wrong, and the company may not even have told you. You can check whether your address appears in known breaches at Have I Been Pwned, a free service run by security researcher Troy Hunt. If it does, follow our data breach checklist.
2. A company shared or sold it
Many privacy policies allow a business to share your details with "partners" or "affiliates". Contest entries, free quote forms, coupon sites and lead-generation pages often exist mainly to collect addresses for resale. A pre-ticked box saying you agree to offers from third parties is the usual way consent is obtained.
3. It was scraped from a public page
Automated programs crawl the web collecting anything that looks like an email address. If yours appears on a company staff page, a forum profile, a public social media bio, a PDF or an old classified ad, it has almost certainly been harvested.
4. It was guessed
Spammers do not always need a list. In a dictionary attack they combine common names and words with popular domains, such as john.smith, jsmith and johnsmith1 at gmail.com, and send to all of them. Short addresses and common names receive more spam for this reason, even when they have never been published anywhere.
5. Someone you know was compromised
If a friend, relative or colleague has malware on their device or loses control of their email account, their whole address book can be copied. Your address is in it. This is also why you sometimes receive scam emails that appear to come from people you know.
6. An app was given access to contacts
Apps and services that ask to "find your friends" upload the contact list from a phone or mail account. If anyone who has your address accepted that request, a company you have never dealt with now holds it.
7. Group emails and forwards
A message sent to fifty people in the To or CC field shows every address to every recipient. When that message is forwarded again, the list travels with it. It only takes one compromised inbox along the chain.
8. Your domain registration
If you have registered a domain name without privacy protection, your contact email may be listed in the public WHOIS record. New domain owners often see a wave of unsolicited web design and SEO offers within days for exactly this reason. Most registrars now offer WHOIS privacy free of charge.
How to find out which one it was
- Check breach databases first. It takes a minute and explains most cases.
- Look at what the spam knows. If it uses your name, the list came from a sign-up form or a breach. If it does not, your address was probably scraped or guessed.
- Look at when it started. A sudden increase a few days after you entered a contest, requested a quote or registered a domain points to that event.
- Tag your sign-ups from now on. With Gmail or Outlook you can add a label after a plus sign, for example yourname+shopname@gmail.com. Mail still reaches your inbox, and if spam arrives at that tagged address you know which company passed it on. A separate alias per site does the same job and cannot be stripped off. See how to set up an email alias.
How to stop it happening again
- Do not give your main address to sites you will use once. A temporary email address receives the confirmation and then expires, so there is nothing to leak or sell later.
- Use aliases for accounts you keep. If one starts receiving spam, switch it off. Our comparison of temp mail and email aliases explains when to use each.
- Keep your address off public pages. Use a contact form on your website, and hide your email on social profiles.
- Use BCC for group emails so recipients cannot see each other's addresses.
- Turn on WHOIS privacy for any domain you own.
- Read the tick boxes before you submit a form.
What to do about the spam you already get
You cannot remove your address from lists that are already circulating, but you can make it far less visible. Never reply to spam, and do not click its links. Report it so your mail provider's filter learns from it. For newsletters from real companies, opting out works, and our guide to unsubscribing safely explains how to tell the two apart. For a full clean-up, see how to stop spam emails in Gmail and Outlook.
Frequently asked questions
Is it illegal for a company to sell my email address?
It depends on where you live and what you agreed to. Under the GDPR in the EU and UK a company needs a lawful basis, usually your consent, to pass your details on for marketing. Laws in Canada and several US states give you similar rights to know and object. In practice the consent is often buried in a policy you accepted when signing up.
Should I change my email address if I get too much spam?
Usually not. Good filtering plus aliases solves most cases, and changing your main address means updating every account you own. Consider it only when the inbox is unusable and filters are not coping.
Does opening a spam email cause more spam?
It can. Many messages contain a hidden image that reports back when the email is opened, which tells the sender your address is active. Blocking remote images prevents this. See how email tracking pixels work.
