30

A few weeks ago I've started noticing spam alike emails coming to my work email address from some small company's VP trying to push their advanced bug detecting software. First, I ignored them and kept marking it as spam. However, the person seems to be extremely persistent and just keeps emailing me follow-ups and eventually asking if he is knocking on the wrong door. I do not usually get involved with things like that but what is the proper thing to do in such situation to keep things ethical and at the same time safe for my employer?

Should I keep blocking him; should I report him to our IT department or should I actually respond by saying literally "sorry, but we are not interested"?

My concern is that I do not want to initiate any kind of communication of such sort via company's email and at the same time I understand that there is no solid reason to be rude to that person, although he DID guess or get hold of my email without my approval.

Improve this question
11
  • 49
    I like hitting "spam" on those sorts of emails because if enough people do it, gmail starts automatically assigning them to spam. I know of at least one email list where they had to send out a "please don't report as spam" email because it had started getting picked up as spam automatically by gmail... (which begs the question, why was it, but I digress)
    – enderland
    Commented Sep 8, 2017 at 16:07
  • 14
    Paranoia kicking in here .. is it possible that this is a spear phishing attempt?
    – Peter M
    Commented Sep 8, 2017 at 16:11
  • 8
    What email system do you use? Most have some kind of function that allows you to block an email address from the client side.
    – user48276
    Commented Sep 8, 2017 at 16:11
  • 4
    If your not sure of the source delete it.
    – Neo
    Commented Sep 8, 2017 at 16:17
  • 5
    I generally ignore the first few, unsubscribe if they continue and if they haven't stopped after the 10 day period send a complaint to the FTC CCing their ISP on the third. So far, every time it's reached that step, I get an e-mail from the ISP saying they've taken action and I no longer receive e-mails from them. The only time this didn't work was when the company was based in India... he started sending twice as much mail... so YMMV. I've also had several remailer reply saying they've terminated a spammer for violating their AUP. A small win, but a win nonetheless.
    – TemporalWolf
    Commented Sep 8, 2017 at 20:56

7 Answers 7

Reset to default
32

The following assumes that this is a legitimate, verifiable company that just too aggressive with its marketing. If you have any reason to believe that it's not a legitimate company (i.e. a spammer) then don't respond and go straight to your IT as well as following my suggestion in the last paragraph.

Respond once (politely) and express to them that you don't want to be contacted anymore. Then if they email you again, see if you can get your IT to just block him.

Also, you can set up a Rule in most mail clients to automatically mark it as read and then delete it so that way you won't have to see it again, even if IT doesn't do anything about it.

Improve this answer
6
  • 49
    I would strongly urge against responding to a spam email. Chances are you will only further put a target on your back and if this happens to be a phisher you just indicated that the company is not filtering the email (which then opens you to additional more targeted attacks).
    – user48276
    Commented Sep 8, 2017 at 16:13
  • 8
    That's a good point. I'm answering under the impression that this is a legitimate software company with over aggressive marketing. If it's spam, I definitely agree. Edited to include your advice. Thank you.
    – Chris E
    Commented Sep 8, 2017 at 16:15
  • 2
    This is also a necessary step if you want to file a complaint with the FTC. In my experience, telling them I've reported them to the FTC and their ISP is usually sufficient to stop legitimate companies from continuing to email me.
    – TemporalWolf
    Commented Sep 8, 2017 at 20:51
  • 2
    Best to NOT respond to unsolicited emails.
    – Kilisi
    Commented Sep 9, 2017 at 0:32
  • 2
    @Mast This link has a list of EU spam laws. spamlaws.com/eu.shtml
    – Chris E
    Commented Sep 9, 2017 at 19:26
11

I have faced a similar situation with a company which organises conferences. What I eventually did was twofold. Firstly, I replied with an e-mail along the lines of

Subject: Unsubscribe

Please unsubscribe me from this mailing list.

After the second such reply, I set up a rule in my mail client to handle any e-mail from that domain with two actions: respond with the following text, and then archive:

Subject: Unsubscribe

This is an automatic reply. I have previously requested to be unsubscribed from this mailing list. All further e-mails from it will be automatically deleted unread.

By keeping the wording strictly non-personal I aim to keep it professional, although I suppose that some might regard it as borderline rude. And by sending a response I aim to waste enough of the sender's time that eventually they decide that it's preferable to actually remove me from their list.

Improve this answer
3
  • 5
    There are two flaws with this approach. First, your assumption that someone will actually read your reply is dubious at best. Secondly, you are creating backscatter.
    – Itsme2003
    Commented Sep 9, 2017 at 17:22
  • Sigh. When I'm not in an exam I don't always remember the adage of my physics teacher: always state the obvious. The scenario here is a genuine company which can't take a hint, not a Viagra spammer who uses random addresses, and I didn't go to that much hassle without first checking that the sender wasn't a no-reply address.
    – Peter Taylor
    Commented Sep 10, 2017 at 7:12
  • 4
    It should be fairly clear to you that if they ignore your first request and send you further communications then by definition, they don't care if you reply asking them to not send more messages. You have to look at the costs associated. It costs them money to remove you from the list because it requires some time on their part. It costs them nothing to leave you on the list. Your threat to delete their future emails without reading them means nothing to them at all.
    – Itsme2003
    Commented Sep 10, 2017 at 16:22
9

There is likely more going on than merely being badgered by an aggressive email marketer, and I recommend taking the following steps for ALL email both personal and business.

  1. Turn off image preview for all email from any source you do not personally know (and even some you do) Why? By allowing images, you allow your VIEWING of the email to be tracked through embedded "tracking images". The marketer now knows he has:

    i. A valid email address and

    ii. that there is someone who reads that email!

    Obviously if they know you're reading the emails, they will/can send you more.

  2. Do not enable image viewing for email that contains only images (for the reason above).

  3. Do not respond. Any portion of the original email may/is likely to contain tracking information which the sender can use to identify you just as described above.
  4. Do not click any links or images contained in the message.
  5. If you DO choose to respond. Keep it short and sweet:

Please unsubscribe me.

  1. By US LAW unsolicited commercial email (UCE) may violate the CAN SPAM act. You can push back in your reply using the bullet points in the sample response above. However be careful as your business may have different policies about how to handle this situation.
  2. Do not be afraid to use the "filter/block/discard this organization" methods present in most email clients.
  3. If I am reasonably sure the business is legitimate, the sender is valid AND it contains an unsubscribe link, I may use the link. However it it is trivially simple to put malicious links in any email. And abundance of caution is better than a dump truck full of problems. BTW: If I do respond, I usually include my own tracking image (aka Web Beacon).

More Information about Web Beacons from wikipedia

Web beacons embedded in emails have greater privacy implications than beacons embedded in web pages. ...

Web beacons are used by email marketers, spammers, and phishers to verify that email addresses are valid, that the content of emails has made it past the spam filters, and that the email is actually viewed by users. When the user reads the email, the email client requests the image, letting the sender know that the email address is valid and that the email was viewed. ...

Tracking via web beacons can be prevented by using email clients that do not download images whose URLs are embedded in HTML emails.

Improve this answer
1
  • 1
    Very thorough answer (and first one also) +1 good job. Welcome to The Workplace :)
    – DarkCygnus ♦
    Commented Sep 8, 2017 at 21:17
6

In my experience, companies will have a standard policy on how to deal with outside domain email addresses. Working for healthcare companies, any unknown domain gets automatically forwarded to a 'dump' and 'review' location. IT Infrastructure / Security will handle it and will either block it or contact you for verification to see if this is legit business and your business reason to contact them.

The fact that outside email domains get through you should be a security question and should be handled by your company as a whole. But this maybe the larger goal rather than answering your question. So onward to your Q.

If I were in your position, I would do 2 things:

  1. Never answer any unknown email domain nor click any links they provide
  2. Always forward unknown / new email domain to your IT to make sure it's safe to reply.

When it comes to outside risk, be extra cautious. Nothing wrong with an overly secure employee that ensures every data is safe.

Good luck

Improve this answer
4
  • 1
    That's pretty harsh handling. I work at a health care company. We get a big ugly red banner inserted in the email warning that it's from outside the domain and an Outlook plugin to automatically report phishing email. It is, however, left the the user to act intelligently on behalf of the company. (I know, that's a pretty big risk, even in health care...)
    – FreeMan
    Commented Sep 8, 2017 at 20:20
  • You must work for much more tech-savvy companies than I do... I've never had this experience (and I work in IT). Mostly they just rely on outlook and some very basic rules.
    – Joe
    Commented Sep 8, 2017 at 21:36
  • Some companies are stricter and some are loose. I personally don't understand why Pre and Post filtering of non network data is not implemented on every company. It's not that hard to do.
    – Isaiah3015
    Commented Sep 8, 2017 at 21:53
  • 1
    @Isaiah3015 - such a strict system is only workable for employees who are sheltered from the outside world. Many others will have legitimate contacts or contacts-in-formation from outsiders. Spammy salespersons exploit the fact that it's hard for an automated system to distinguish between initial contacts that are potentially useful and those that aren't - a little "cold" vs "following up on our conversation last night at the xxx meetup" is possible but would be routinely faked by the low-end promoters, and could easily block actual followup attempts if someone doesn't use the magic words.
    – Chris Stratton
    Commented Sep 9, 2017 at 16:39
3

This 'small company', I'm assuming they are not a client or partner of your company. If they are harassing you like this, get your IT guys to block their email domain.

It's getting in the way of your own work, their product doesn't meet with your approval and might be causing you undue stress. I'm sure your bosses won't complain about this.

Improve this answer
1
  • I've looked them up in my spare time and they seem to be a legitimate software solutions provider. They are not our client and their software has some potential within a company like mine but I am not the one to make calls here.
    – eYe
    Commented Sep 8, 2017 at 16:46
3

Update: Note that some companies have existing policies for security reason that you should follow if your company is like this. For example my company does not want us to follow link from unknown emails or from unfamiliar contacts. This is to help prevent any chance of malware or viruses getting to your system.

If you are a person with the authority to make decisions on the matter and do not want their software they are advertising I would reply with a simple email stating that your company is not interested in the product. You don't need to be rude or anything. Something along the lines of "Thank you for contacting us. Currently we do not have a need for your software" If they persist after that just create an email filter to automatically rout all their emails to the trash bin.

You could even request IT filter out their emails but that should not be needed unless their emails are malicious in nature. IE: Malware or harassment.

If you are not someone who can make these kinds of decisions I would bring it up to someone who does or the proper routs to bring it to the attention of someone who does and then create a email filter to trash all their emails so it is out of your hands and you can rest easy know you did what you should in this situation.

Improve this answer
3

If you do not want to contact the person directly, the easiest solution is to block the emails themselves. You noted that you use Outlook with Exchange Server, so you have the ability to set up rules that process emails according to whatever criteria you specify. You can set up a rule to either move the emails or delete them outright. You can also use the 'Junk' feature to block the sender or even his entire company. Here's a screenshot showing these two items in Outlook 2016. Older versions of the Outlook client have these features as well, although they may be in a slightly different location.

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .