Where scam emails come from
A walk from the inbox you know back to the companies that had your details, and how those details got out.
Scroll
“I get scam emails every day, just like all of us. Have I ever clicked on one? To be honest, I have, just out of curiosity at times, to learn how they are even planning to scam me, and why.”
Akash WadhwaniMost of them are easy to laugh at. A prince with $14.5 million is not a serious offer, and the people who send it know that.
Sending an email costs almost nothing, so they send millions. Picture every dot here as one email sent. Nearly everyone ignores them. A few reply.
The silly ones are silly on purpose. Every reply costs the scammer time, so they only want people who will go all the way. An email most people laugh at sorts the inbox for them, down to the few most likely to pay. A Microsoft researcher, Cormac Herley, showed this in 2012 in a paper called “Why do Nigerian scammers say they are from Nigeria?”
Losses from online crime reported to the FBI in 2025:
$20 billion+That is up from $16.6 billion the year before, and most people who lose money never report it.
The other kind is harder, because it knows your name and the bank you actually use. Those details came from somewhere.
Start with you. You are one record: a name, an email address, a phone number, maybe a card.
you
You are not in one place. Every company you signed up with keeps its own copy of you, in a list with everyone else. The list is called a database, and it sits on a server, a computer that stays switched on in a building somewhere so the company's website and staff can reach it.
youeveryone else
A data leak, or breach, is when a copy of one of these lists ends up with someone who should not have it. Once it is out, it can be copied forever.
There are only a handful of ways out. Each one below happened to a real company, and each is told from the official record.
Two CDs in the post
The simplest leak is physical: a disc, a laptop or a box of paper goes missing.
In 2007 Britain's National Audit Office asked the tax office for a sample of child benefit records. Its email said: “I do not need address, bank or parent details.” Removing them would have cost money, so the whole file went. Two CDs holding the records of 25 million people went into the internal post, protected by one short password. They were never found.
A contractor's login
Companies let other companies into their systems: cleaners, payroll firms, IT firms. If one of them is careless with a password, the door is open.
In 2013 attackers got into Target, the US store chain, with a login belonging to its heating and air-conditioning contractor, then reached the card machines at the tills. About 40 million cards were stolen. Target found out from a phone call from the US Justice Department.
A patch nobody installed
All software has mistakes. When one that lets strangers in is found, the maker publishes a fix, called a patch, and every company using that software has to install it. Attackers read the same announcements.
In 2017 Equifax, which holds credit records on most American adults, missed one. The tool meant to spot attackers had been blind for 19 months, because a security certificate, a kind of digital ID card, had expired. The night staff renewed it, they saw data leaving for China. About 147 million people were affected.
One digit in a link
When you open a document online, its number is often in the address. A careful website checks the document is yours before showing it. A careless one does not. Try it on an invented title company:
In 2019 a customer of First American, Ben Shoval, did exactly this and saw strangers' mortgage papers. About 885 million documents were open to anyone with a browser for four and a half years. The company's own testers had found the flaw, rated it “medium”, and it was filed as “low” by mistake. It was fixed 133 days after their report, when the journalist Brian Krebs called.
A setting left open
Many companies rent storage from cloud providers like Amazon. Settings decide who can open each folder, and one wrong setting can let a stranger in.
In 2019 a misconfigured firewall at Capital One let an outsider borrow a server's own key and copy files from more than 700 folders, about 100 million people's applications. The bank found out 127 days later, from an email a stranger sent to its tip line.
A phone call to the help desk
The easiest lock to pick is a person. Attackers phone or message staff pretending to be colleagues, usually from IT, and ask them to log in to a fake page. This is called phishing, or social engineering.
In July 2020 a 17-year-old and two others phoned Twitter employees as the IT help desk, collected their logins on a fake page, and posted from the accounts of Elon Musk, Apple, Bill Gates and Uber asking for bitcoin.
A reused password
Most people reuse passwords. When one site leaks, attackers try those email and password pairs on every other site. A code sent to your phone, called two-factor login, stops this, because the password alone is not enough.
In 2023 reused passwords opened about 18,000 accounts at the DNA testing company 23andMe, and a feature showing your relatives turned those into about 7 million people exposed. Canada's privacy commissioner recorded that the company “decided not to make MFA mandatory as they wished to avoid friction in the user experience”.
Where it goes
Stolen lists are sold on forums where criminals trade. One of them, BreachForums, listed 888 databases holding 14 billion records, bought with credits worth about 25 cents each. An undercover FBI agent paid about $5,000 for the Social Security numbers and bank details of 15 million Americans.
Buyers merge many leaks into giant lists of names, emails and passwords.
And the lists come back to you: as login attempts on your accounts, and as emails that know your name and your bank.
Have I Been Pwned, a free site where anyone can check whether their email was in a leak, now counts about 17.8 billion breached accounts, counting a person once for every breach they are in.
How long companies take to tell you
Most US states make companies tell you when your data leaks. In Washington State the deadline is 30 days, and the state publishes every notice. Over ten years, companies got much faster at noticing a breach and much slower at telling anyone.
Median days by the year the breach was noticed, from 1,690 notices on data.wa.gov (dataset sb4j-ca4h). “Told” is when the state received the notice. 2025 is still filling in, so it reads low.
“Unauthorized access”
When the letter finally comes, it often doesn't say how. We read a random sample of 61 breach letters filed with California's attorney general. Each square is one letter. Tap one to read what it said.
says how they got inpartly (a vendor, a theft)never says how 30 of 61 never say how. A sample this size is accurate to about 12 points either way.
Who notices first
Often it isn't the company. Capital One learned of its breach from a stranger's email. First American's was found by a customer, then confirmed by a journalist. And the people looking for open doors are fast: Bob Diachenko once left a fake open database online as bait, and the first attack came 8 hours and 35 minutes later.
Some of the people who scan for open databases report what they find.
“If I found it, anyone else could.”
Jeremiah FowlerReporting a leak can go any way. Noam Rotem rang a company that had left a million fingerprints open: “We started calling all of the offices one by one and had to deal with people just hanging up the phone.”
One Christmas, Chris Vickery found an escrow company's records open online. Its IT person said the fix would take a week. Vickery looked up the boss's home number and rang him at 2 am.
“Half an hour later, 2:30 a.m., it was secured.”
Chris VickeryThe people it happened to
“That's when the fear set in. I took sick leave from work, I closed myself in at home.”
Meri-Tuuli Auer, whose therapy notes leaked from the Finnish clinic Vastaamo, to the BBC. Finland's regulator found the patient database open to the internet for 16 months, with an admin account that had no password.“It's just exacerbated everything – the anxiety, the insomnia, the fear.”
Veronica Bloom, a Medibank customer, to the ABCBack to the inbox
Akash checked his own email address on Have I Been Pwned. It was in eight breaches. These are the shops and apps among them:
- 2018
- Elanic, fashion marketplaceemail, location, username
- 2018
- DailyObjects, online storename, phone, home address, password
- 2018
- Zoomcar, car rentalname, phone, password
- 2019
- Canva, design toolname, city, password
- 2020
- 123RF, stock photosname, phone, home address, password
- 2020
- Gravatar, profile pictures (scraped)name, username
- 2022
- SevenRooms, restaurant bookingsname, purchases
Elanic told Have I Been Pwned the data came from “one of our test servers where this data was exposed publicly”, a door left open, and that it had “decided to not have as such any communication and public disclosure”.
So here is the email from the top of the page again, read with that list beside it.
- His name was in at least six of the eight breaches.
- His phone number and home address were in DailyObjects, Zoomcar and 123RF, enough to follow up by text or call.
- The bank is a guess. HDFC is India's largest private bank, so a guess like that is often right, and when it is, the email feels like it knows you.
Nobody had to hack Akash. A fashion site left a test server open, a few shops and apps lost their customer lists, and his details went into the same lists as everyone else's.
You cannot lock other companies' doors. Two things make a leaked copy of you far less useful: a password manager, so every password is different, and two-factor login on anything that matters.
Check your own email on Have I Been Pwned →
If you want two minutes away from all this, we make a daily word game called Long Story Short.