Unsubscribe Links Are a Sneaky Phishing Vector

Published

Maybe you want to be nice. Maybe you don’t want to hurt another well-meaning business' email delivery because you know from experience how painful debugging deliverability issues can be. So you click the unsubscribe link or you click the unsubscribe button that Gmail handily derives from the email.

Then you land on a phishing site. You maybe enter in your email to confirm unsubscribe like many an unsubscribe page has trained us to do before. Maybe it asks you to log in. Maybe you just gave your password to the phisher or confirmed that you do indeed have a FooCorp account.

Sad to say, but it’s safer to mark-as-spam. There are no penalties for the receiver. You can always undo it later.

See also: