The Opt-Out Trap: Why Unsubscribe Links Are a Phishing Favourite in 2026

Unsubscribe used to be the grown-up exit from marketing mail. In 2026 it is also a useful hook. The same footer link that lets a legitimate retailer stop emailing you can be cloned by a scammer to harvest a password, confirm a live inbox or push you toward a fake preference centre. The advice ‘just click unsubscribe’ needs a caveat the size of a Royal Mail van.

This is not about abandoning unsubscribe entirely. It is about using it with the same suspicion you would apply to a link asking you to ‘verify your account’. Spamdex’s view is simple: unsubscribe is for mail you recognise and no longer want. Report is for mail you do not recognise. The two actions are not interchangeable.

Why the opt-out link became a target

Attackers follow behaviour. People have been trained to look for an unsubscribe link as a sign that an email is legitimate. Scammers know this, so they copy the footer furniture: the tiny grey text, the preference-centre wording, the ‘you are receiving this because you signed up’ line. The email does not need to steal a password on page one. It only needs a click, because a click confirms the address is live and the recipient is willing to engage.

There is also a technical angle. Modern mail clients often show a native unsubscribe button when a message includes a List-Unsubscribe header. That is brilliant when the sender is genuine. It is less brilliant when the header points to an attacker-controlled domain or a mailto address that simply confirms your address to a list operator. The native button feels safe because it is part of your email app. That is exactly why it is worth checking before you press it.

Three traps to recognise

The fake preference centre

You click unsubscribe and land on a page that asks you to sign in, confirm your email and password, or ‘verify your identity’ with a card. A real unsubscribe should not need your password. It definitely should not need payment details. If the page asks for either, close it. You are not managing preferences; you are feeding a phishing form.

The header and redirect trick

Some links look harmless in the footer but route through a chain of tracking domains before landing somewhere unexpected. On a desktop, hover over the link and read the domain. On mobile, long-press it. If the domain does not match the brand, or if it is a shortener with no obvious reason to exist, treat it as suspicious. The same applies to the List-Unsubscribe header: a legitimate one-click opt-out should not open a login page or ask you to reply with personal details.

The reply-to trap

‘Reply STOP to unsubscribe’ works for some SMS services. In email, replying to a suspicious message can simply confirm that a human is reading the inbox. It may also start a conversation with a scammer who now knows you are receptive. Legitimate bulk senders use automated preference centres, not a reply-to address that invites you to negotiate your exit.

How to tell a real unsubscribe from a lure

Start with the relationship. Did you actually sign up? Is the sender a brand you recognise? Is the email recent and consistent with what you expected? If the answer is no, do not use the unsubscribe link. Use your mail provider’s report-junk button, block the sender and move on.

Then check the legal furniture. Legitimate UK marketing email should identify the sender and include a valid postal address. The unsubscribe route should be clear and should not require credentials. The link domain should match the brand’s main domain or a known email service provider. Urgency is another clue: ‘your subscription will be cancelled unless you confirm’ is a phishing trope, not a normal preference centre.

If you want to unsubscribe from a sender you recognise but the email feels slightly off, do not use the link. Open the brand’s website directly, log in there and manage your preferences from the account page. That route is slower, but it keeps you away from whatever the email was trying to sell you.

If you have already clicked

Do not enter any details. Close the page. If you typed a password, change it immediately, turn on two-factor authentication and check your sent items for anything you did not send. If you entered card details, contact your bank. If you replied to the email, expect more contact and block the sender. Then report it: forward suspicious email to [email protected], the NCSC’s Suspicious Email Reporting Service, and use Action Fraud if you have lost money or handed over personal information. Your email provider’s report button also helps its filters learn.

Reporting routes that actually do something

For suspicious email, the NCSC reporting service is the quickest national route. For fraud or cybercrime with a financial or personal-information impact, Action Fraud is the place to go. If a legitimate UK company keeps emailing after you have opted out, the Information Commissioner’s Office handles concerns about nuisance marketing and data protection; keep the headers and dates. And always report junk inside your mail app. It feels small, but it feeds the filters that protect everyone else.

The rule I use now

Unsubscribe from mail you recognise and no longer want. Report anything you do not recognise. If an opt-out page asks for a password, a card or a reply, it is not an opt-out page. It is a lure with a footer.