The Alias Ledger: Which of Your Burner Addresses Is Quietly Selling You Out

You signed up for a free trial eighteen months ago, tapped "Hide My Email", and felt quietly smug about it. The trial ended, the app got deleted, and somehow your real inbox is now getting three emails a day about cryptocurrency, a parcel you didn't order and a HMRC refund you definitely aren't owed. The alias didn't fail. It did exactly what it was built to do — and that's the problem.

An Alias Is a Forward, Not a Force Field

Every service in this space works the same way underneath. Apple's Hide My Email, SimpleLogin, Firefox Relay, DuckDuckGo's Email Protection: they mint a unique address, accept mail on it, and forward the whole thing to your real mailbox. The merchant never sees your actual address at signup, which is genuinely useful. But the alias is not a wall. It's a pipe, and every pipe has two ends.

The moment a message crosses that pipe, the alias stops being a secret and becomes an identifier. It sits in the To: line of every email that company sends you, in every newsletter footer, in every mailing list export, in every database that gets copied to a third-party marketing platform because someone in legal said it was covered by the privacy policy. From there, it can travel a long way without your permission.

Five Ways a Burner Address Turns Into a Paper Trail

The reply-to reflex. You reply to an alias from your real address because your mail client defaults to it, and now the sender has both. Some clients keep the alias in the From:, some don't — check yours before you assume.

Reuse. It is astonishingly common to find one alias doing duty across six or seven sites because it was the one you remembered. One leak now points at all of them.

Breach dumps. Alias services protect your inbox, not the alias itself. If a shop you used gets breached, your alias is in the dump alongside your name, delivery address and the last four digits of a card. That's plenty to build a convincing phishing email around.

Chained forwarding. The alias forwards to an old address, which auto-forwards to your current one, and nobody has looked at the middle link in years. This is how mail arrives from a service you closed in 2023.

The invisible third party. The alias appears in the To: line of mail the merchant sends. Anyone copied, anyone on the same list, any support agent who forwards it internally can see it. It was never confidential, only unique.

The Tell: Mail You Never Asked For, at an Address You Barely Use

The signature of a leaking alias is a change in the sender mix. An alias you created for a single clothing retailer should only ever hear from that retailer and its delivery partners. When it starts receiving messages from a loan comparison site, a survey panel and something called "Rewards Hub", you can be fairly confident the address has been passed around.

There are two sharper tests. First, check the greeting: "Dear promo-7f3a2b" means the sender bought a list and never bothered to parse it. Second, look at the volume curve. Ten emails a month is a marketing department. Sixty emails a month from twenty different domains is a distribution network, and your alias is a stock item in it.

Running the Audit in a Single Evening

Set aside an hour and treat it like a small piece of forensic admin.

1. List your aliases. Apple's Hide My Email screen shows every address you've generated and which app it belongs to. SimpleLogin and Firefox Relay both give you a dashboard with per-alias activity. Export or screenshot the lot.
2. Hunt the orphans. For each alias, write down whether you still use the service. Anything you can't place is a candidate for retirement.
3. Search your mailbox by recipient. Most clients let you search to:alias or the alias domain. Do it for each one and note the monthly message count.
4. Check for breaches. Run the aliases through Have I Been Pwned. A hit isn't fatal, but it tells you the address is circulating outside the company you gave it to.
5. Look for duplicates. If two services share one alias, split them. You've just lost the ability to tell which one leaked.

A simple sheet works fine: alias, service, date created, messages per month, breach status, verdict.

Burn, Keep, or Quarantine

Not every noisy alias deserves to die. Keep anything you still log into, anything that carries a financial relationship, and anything receiving fewer than ten messages a month. Quarantine the middle tier: leave the alias alive so password resets still work, but add a filter that labels and archives everything matching it, so it never touches your main view. Burn the ones that are spiking, breached, or receiving mail from domains you never handed over.

Burning usually means disabling forwarding and, where the provider allows, deleting the alias. That kills the pipe. It does not remove your alias from the sender's database — the merchant will keep mailing an address that now bounces, which at least does your sender reputation no harm since it isn't your domain. It may, however, trigger a hard bounce that a legitimate service interprets as "this customer has gone", which is exactly what you want.

Before You Burn: The Account Recovery Trap

Here's the mistake that costs people a weekend. An alias quietly becomes the recovery route for an account you actually care about — a domain registrar, a bank's notification address, a work tool. Disable it and the next password reset goes nowhere.

Before you kill anything, open the account settings of every service that uses it and check the contact email. Migrate first, log in from the new address, then burn. If you can't get in, don't burn.

Keep a Ledger, Not a Memory

Aliases work best when you treat them like receipts rather than secrets. One alias per service, a note in your password manager recording what it was for and when you created it, and a five-minute review every few months. If a service annoys you or gets breached, you know precisely which address to cut.

UK users have a small extra lever here: a subject access request or erasure request under UK GDPR to a company that's clearly flogging your alias is cheap to send and occasionally gets results. It won't scrub the list brokers, but it does put a marker down.

The whole point of a disposable address is that it should be disposable. If yours has been quietly forwarding spam for a year because you never checked, it stopped being disposable a long time ago — it's just a second inbox with worse hygiene.