Scam vs Spam
Also known as: phishing, smishing, vishing, business email compromise, advance fee fraud, email fraud
Spam refers to unsolicited bulk messages sent indiscriminately to large numbers of people -- typically for marketing, advertising, or as vectors for scams.
Scams are deliberate deceptions designed to manipulate victims into providing money, personal information, or access to accounts. The two often overlap: scams are commonly delivered via spam channels (email, SMS, social media), but they are distinct concepts. Spam may be annoying but legal (commercial email with an unsubscribe option); scams are illegal fraud. Not all spam is a scam (legitimate but aggressive marketing is spam), and not all scams are delivered via spam (targeted social engineering, catfishing, and business email compromise are scams without spam's mass-broadcast quality).
Scam vs Spam, explained at three levels
At home
Spam is junk messages -- emails or texts you did not ask for, sent to thousands of people at once, usually trying to sell something or get your attention. Most spam is just annoying. A scam is different: it is a deliberate lie designed to steal your money or personal information. Scams often arrive as spam ('You won a prize! Click here') but are more dangerous because they are trying to hurt you financially. Not all spam is a scam (some is just unwanted advertising), but all scams that arrive in bulk are spam.
At work
Organizations face spam and scams on two fronts: externally (employees receiving phishing emails, SMS scams, or social engineering attempts) and internally/reputationally (their company's domain being used to send spam, or their brand being impersonated in scam emails targeting customers). Email security tools (spam filters, DMARC/DKIM authentication), employee security training for phishing recognition, and brand monitoring for impersonation are the key protective measures for most organizations.
At home
Common scam types to recognize: phishing emails impersonating banks, government agencies, or tech companies asking you to 'verify your account' through a link (always go directly to the company's website, never through email links); 'advance fee fraud' / 419 scams (you must pay a fee to receive a larger windfall); tech support scams (calls or pop-ups claiming your computer has a virus, directing you to call a number where they gain remote access); romance scams (catfishing that eventually requests money); prize and lottery scams; and job scams (fake employment offers requiring upfront fees or personal information). Urgency and secrecy are reliable scam signals: legitimate institutions give you time to verify and do not ask you to keep your interaction secret.
At work
Business email compromise (BEC) is a targeted scam (not spam) that impersonates executives or suppliers via email to redirect payments or extract credentials. BEC costs organizations more than any other cybercrime category according to FBI IC3 reports -- losses in the billions annually. Key BEC variants: CEO fraud (email appearing to come from CEO requesting urgent wire transfer), vendor fraud (impersonating a known vendor with 'updated' bank account details), and payroll fraud (impersonating HR processes to redirect payroll direct deposits). Defenses: out-of-band verification for any payment change requests (call the requestor on a known number, not one in the email), dual-approval for wire transfers, and DMARC email authentication to prevent domain spoofing.
At home
The economics of spam and scams: spam works at statistical scale -- if you send 10 million emails, even a 0.01% response rate generates 1,000 victims. The cost of sending bulk email or SMS is near-zero, making the math work for fraudsters. Scam operations have professionalized dramatically: offshore call centers operating romance scams and tech support scams use scripts, management hierarchies, performance metrics, and customer relationship management tools. The 'pig butchering' scam (months-long relationship-building before cryptocurrency investment fraud) is run by teams with shift schedules and specialized roles (conversation managers, payment processors, 'closers' who request the final large payment).
At work
Technical email authentication to reduce domain spoofing and phishing: SPF (Sender Policy Framework) specifies which servers can send email from a domain; DKIM (DomainKeys Identified Mail) cryptographically signs emails to verify they were sent by the domain; DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with emails that fail SPF/DKIM checks (none, quarantine, or reject). Organizations that implement DMARC with a 'reject' policy prevent their domain from being used in spoofed phishing emails. Google and Yahoo now require DMARC authentication for bulk senders to their platforms (2024). Organizations without DMARC configurations are more vulnerable to impersonation in phishing attacks.
Real-world examples
At home
Jerome received an SMS message saying his parcel delivery had failed and asking him to click a link and pay a $3 re-delivery fee. The SMS had the branding of a major courier company. He recognized this as a 'smishing' scam: he had not ordered anything, the link URL was not the courier's real domain (he checked by hovering over it on his laptop), and the urgency was typical of scam tactics. He reported the SMS to his carrier's spam reporting number (7726 / SPAM in many countries).
At work
Fatima worked in accounts payable for a construction company. She received an email from what appeared to be their primary materials supplier, asking her to update the supplier's bank account information before the next invoice payment. The email seemed professional and the sender name matched the supplier's contact. Following her company's security protocol, she called the supplier's main number (from their website, not the email) before making any changes. The real supplier confirmed no such request had been sent -- the email was a BEC vendor fraud attempt. The two-minute verification call prevented a significant fraudulent transfer.
How it compares
| feature | Scam | Spam |
|---|---|---|
| Definition | Deliberate deception designed to steal money or personal information | Unsolicited bulk messages sent indiscriminately to large numbers of people |
| Intent | Always fraudulent -- steal money, data, or account access | Varies -- from legitimate aggressive marketing to scam delivery |
| Legal status | Always illegal (fraud) | Varies -- commercial spam with unsubscribe option may be legal; scam spam is illegal |
| Examples | Phishing, romance fraud, BEC, tech support fraud, advance fee fraud | Unsolicited marketing emails, SMS marketing blasts, social media comment spam |
| Key defense | Verification of requests, skepticism of urgency, security training | Filters, unsubscribe mechanisms, sender authentication (DMARC) |
Spam is the delivery mechanism (unwanted bulk messages); scams are the fraudulent intent. Scams often arrive via spam channels, but targeted scams (like BEC or catfishing) are not spam. Spam can be annoying but legal; scams are always fraud.
For analysts
For enterprise clients, the highest-priority scam mitigation is not spam filtering (mostly solved by email platforms) but BEC prevention: executive impersonation and vendor payment fraud cause the largest financial losses. The practical recommendation is: implement DMARC email authentication to prevent domain spoofing, establish mandatory out-of-band verification protocols for any payment change requests or wire transfers, and run quarterly phishing simulation tests that include BEC-style scenarios (not just obvious 'click this link' phishing). BEC attacks succeed by exploiting normal-seeming processes rather than obvious technical tricks -- the defense is procedural controls, not just technical ones.
History & origin
The term 'spam' as unwanted online communication comes from a Monty Python sketch ('Spam, Spam, Spam...') that was adopted by early internet users in Usenet and MUDs (early text-based games) to describe repetitive, unwanted messages. Commercial email spam began in 1994 with a mass email from lawyers Canter and Siegel advertising immigration services -- widely considered the first intentional commercial spam. Email spam peaked in the mid-2000s (at one point comprising 90%+ of all email traffic) before filtering technology significantly reduced inbox-reaching spam. SMS spam ('smishing' when designed to scam) grew as mobile penetration increased. Social media spam (fake accounts, comment spam, direct message spam) emerged with each platform. Modern scam delivery has grown more sophisticated: phishing (impersonating trusted institutions), voice phishing/vishing (phone calls impersonating banks or government agencies), and smishing (SMS with malicious links) are the primary channels.