Do Not Unsubscribe From Emails — You May Get Hacked

Picture this: Your email inbox has hordes of promotions, unsolicited pitches, financial advice, and more, and all you want to do is clear the mess up for good, instead of spending time deleting.

You reach for the seemingly safe “unsubscribe” button. But before your next blink, you’ve inadvertently opened yourself to a malicious website and, worse, a potential hacker trying to install malware or attempting phishing attacks.

The question arises: Why would you trust an “unsubscribe” link if you don’t trust the sender?

You shouldn’t!

According to a new report by The Wall Street Journal, which cited investigation by DNSFilter, one out of 644 hits on unsubscribe buttons takes users to potentially dangerous websites. Email validation, which notifies spammers that a mailbox is active, malware installation, and phishing are among potential risks when hitting the unsubscribe button.

Cyber criminals are increasingly using unsubscribe links to target unsuspecting users. Clicking on these links basically tells malicious actors that you’re not a bot but a real person, making you a potential target for cyber threats. “You’ve left the safe, structured environment of your email client and entered the open web,” DNSFilter’s TK Keanini told WSJ. 

Users can end up exposed to dubious data harvesting, virus downloads, or phishing websites as a result. Cybercriminals may then attack users with more advanced scams or social engineering attempts. “It can make you a bigger target in the future,” Michael Bargury, co-founder of AI firm Zenity, told WSJ. 

The built-in “list-unsubscribe” headers in your email client, which are usually present at the top of authentic emails, should be used. These are controlled by email providers and do not open dangerous websites. If that’s not possible, flag the email as spam or set up a filter to block similar ones in the future. 

Use throwaway or alias emails for signups to maintain long-term inbox hygiene. Browser privacy add-ons, like Apple’s “Hide My Email” can conceal your address. 

Certain unsubscribe pages even request login information, which is a dead giveaway of malicious intent and should never be done.