When the unsubscribe link is the trap

Two kinds of unwanted email

There is mail you once requested and no longer want: a shop newsletter, event list or product update. Then there is mail with no legitimate relationship at all: fake invoices, invented prizes, password warnings and bulk spam.

For the first kind, a genuine unsubscribe mechanism is useful and responsible senders are expected to honour it. For the second, clicking anything tells an unknown party that the address is active and may lead to a phishing page or harmful download.

Do not ask a stranger’s message to prove that the stranger is trustworthy.

When unsubscribing is reasonable

Use the unsubscribe option when you recognise the organisation, remember joining the list and the message’s domain matches the real company. A mail provider’s built-in unsubscribe control can be preferable because it may use standard list information rather than opening an arbitrary page.

If you are unsure, visit the company through a bookmark or an address you type yourself. Change communication preferences inside the genuine account instead of following the message.

When to leave the link alone

• You never had an account or relationship with the supposed sender.
• The message creates urgency, threatens a charge or demands personal information.
• The visible sender and destination domain do not match.
• The message has unexpected attachments or a shortened link.
• Its only purpose appears to be making you react.

Mark suspicious mail as spam or phishing, then delete it. CISA specifically warns that an “unsubscribe” link inside a phishing message can itself be malicious.

A cleaner exit

A dedicated alias gives you another option. When a legitimate list ignores requests—or an address has become a magnet for unrelated junk—you can retire that route instead of negotiating with every sender using it.

That is not a substitute for reporting fraud. It is a boundary: trusted newsletters get a proper goodbye; strangers do not get a click.