Spam vs. Phishing: Junk Email Examples and How to Tell Them Apart

Spam, or junk email, is unwanted bulk email, usually advertising. It's annoying, but it isn't built to steal from you. Phishing pretends to be someone you trust to get your sign-in details, money or access. The quick check: spam wants your attention; phishing wants an action, like signing in, paying or replying.

The difference matters because you report them differently, and because the two land in very different places once you do.

Junk email examples

These are the messages most people mean by "junk." Annoying, but not dangerous in themselves:

• The trade-show follow-up. You scanned your badge at a booth, and now you get a weekly newsletter.
• The cold pitch. "I noticed your website could rank higher on Google…" from an agency you've never heard of.
• The list you didn't join. A vendor bought or shared a contact list, and you're on it.
• The once-a-customer store. You bought one thing in 2023, and the daily deals never stopped.
• The miracle product. Supplements, gadgets and "limited time" offers from senders you don't recognize.

Legitimate senders must give you a working way to opt out. Under the CAN-SPAM Act, a business has to honor an opt-out request within 10 business days (FTC).

Phishing email examples that look like junk

Some phishing is dressed up as ordinary marketing, so it slides past people who are skimming:

• The fake order confirmation. "Thanks for your order of a 15-inch laptop: $1,299.00. Not you? Click here." The "click here" is the point.
• The fake unsubscribe. A spammy message whose "unsubscribe" link leads to a sign-in page.
• The prize or survey. "Complete this 30-second survey for a $100 gift card" that ends by asking for card details.
• The "you've been charged" renewal. A receipt for a subscription you never bought, with a phone number to call for a refund.

For more, see our phishing email examples with every red flag marked.

Spam vs. phishing, side by side

The gray zone: scam spam, like fake prizes and miracle investments, sits between the two. If an email asks for money or personal information, treat it as phishing.

Should you click "unsubscribe"?

Only for senders you recognize and remember signing up with. For those, unsubscribing works, and Gmail's own help recommends it for messages you signed up for and no longer want (Google). For senders you don't recognize, skip the link and report the message as junk instead.

How to report junk vs. phishing

Outlook (web and new Outlook): select the message, choose Report, then Report junk or Report phishing. Junk moves to the Junk Email folder and the sender is blocked. Phishing reports delete the message, and depending on your organization's settings the report goes to your IT team, to Microsoft or both (Microsoft).

Gmail: for junk, select the message and click Report spam (Google). For phishing, open the message, click More next to Reply, then Report phishing (Google).

At home: you can also forward phishing to reportphishing@apwg.org and report scams at ReportFraud.ftc.gov, as the FTC recommends.

Why the right button matters at work

A junk report mostly teaches your filter what you don't want to see. A phishing report reaches the people who can pull the same message from every other inbox before someone else acts on it. That's why Hook treats the reporting rate as the most important number in a security awareness program: one fast report can protect the whole company.

When in doubt, report it as phishing. A security team would much rather review a newsletter than miss an attack.

Frequently asked questions

Is junk email dangerous?

Most junk email isn't dangerous on its own; it's unwanted advertising. The risk is phishing that looks like junk. Don't click links in junk from senders you don't recognize, and never sign in from one.

Is spam the same as phishing?

No. Spam is unwanted bulk email, usually marketing. Phishing impersonates someone you trust to steal sign-in details, money or access. Some phishing is sent in bulk like spam, which is why the two get confused.

What is an example of junk email?

A daily deals newsletter from a store you bought from once, a cold sales pitch from an agency, or a mailing list you never joined.

Why do phishing emails sometimes land in my junk folder?

Because filters catch a lot of phishing and file it with spam. That's a win, not a reason to trust it. Anything in the junk folder that asks you to sign in or pay should be reported as phishing.

Should I report spam or just delete it?

Report it. Marking junk teaches your filter. Reporting phishing alerts your security team. Both are better than deleting and moving on.

Build the reporting habit

Reading about the difference helps; practicing it in your own inbox builds the habit. Hook Security's phishing simulations send safe look-alikes of real phishing, including the kind dressed up as junk, so your team gets practice choosing the right button before a real one arrives. See it on your own team with a demo.

Keep reading

• Phishing email examples with red flags
• Common email scams: 10 examples
• Email spoofing examples: 6 spoofed emails and how to spot them
• What to do if you click on a phishing link