Spam, Scam or Phishing? Why the Difference Changes What You Should Do

People often use spam, scam and phishing as interchangeable labels. In everyday conversation that is understandable, but the distinction matters when you decide what to do next.

The anonymised IsThisSpam dataset contained 2,369 scam classifications and 273 spam classifications, alongside phishing-like messages involving fake logins, account alerts and payment requests. Commercial language also appeared across safe, spam and scam outcomes.

The same surface pattern can lead to different risks. An unsolicited sales email may be annoying. A fake sales proposal may be fraudulent. A message pretending to be your email provider may be phishing for credentials.

What is spam?

Spam is unsolicited or unwanted bulk communication.

Common examples include:

Spam can be lawful, unlawful, misleading or harmless. The defining feature is usually unwanted volume or poor consent, not necessarily an attempt to steal.

Typical response to spam

A legitimate marketing message can still be spam to the recipient.

What is a scam?

A scam is a deceptive scheme intended to obtain money, access, data or another benefit.

Examples include:

A scam may arrive by email, SMS, phone call, social media or a website. It does not need to ask for a password, so not every scam is phishing.

Typical response to a scam

What is phishing?

Phishing is a form of deception designed to make you reveal credentials, financial details, one-time codes or other sensitive information, often through impersonation.

Common phishing lures include:

Phishing often uses a fake login page, malicious attachment or reply-based conversation.

Typical response to phishing

One message can fit more than one category

A bulk email advertising a questionable investment may be both spam and a scam.

A fake delivery notice sent to thousands of recipients may be spam, phishing and a scam at the same time.

A real marketing email may be spam without being fraudulent.

This overlap is why a useful checker should explain the harmful behaviour instead of relying only on one label.

A fast classification test

Ask these questions in order.

1. Was it expected or requested?

If not, spam becomes more likely, but unexpected contact alone does not prove fraud.

2. Is the sender making a false claim?

Impersonation, fabricated authority, impossible promises and invented emergencies point toward a scam.

3. Is the message trying to collect credentials or codes?

That is a strong phishing indicator.

4. Is money or financial access involved?

Payment, cryptocurrency, gift cards, bank-detail changes and remote access increase scam risk.

5. Is the primary problem volume or deception?

An irrelevant sales pitch may mainly be spam. A carefully targeted payment request may be a scam even if it was sent only once.

Why the distinction helps businesses

Businesses also need to understand the boundary.

A legitimate sales email can look fraudulent when it has:

Pre-send checking can help teams reduce spam-like patterns before customers report their messages. It can also prevent compromised accounts from distributing phishing content.

What to submit to a checker

Paste the full message, including:

Remove passwords, one-time codes, account numbers and identity documents.

Use the email spam checker for unwanted commercial messages, the scam email checker for suspicious email content, or the SMS scam checker for text messages.

The practical rule

Spam asks for your attention.

A scam tries to deceive you for gain.

Phishing tries to capture access or sensitive information.

They can overlap, but the response should match the highest-risk behaviour present. When a message asks for money, credentials or secrecy, treat it as more than an inbox-cleanliness problem.

Data note: This article is based on aggregate classification patterns in 13,547 public checks. Commercial-message themes were grouped at category level. No original sender, campaign, email body or personal detail has been reproduced.