Spam vs. Phishing: What's the difference?
Both spam and phishing arrive in your inbox uninvited, but they have very different goals — and knowing the difference helps you respond appropriately.
Spam
Spam is bulk, unsolicited email sent to large numbers of people, usually for commercial purposes. Think of it as the digital equivalent of junk mail.
Common examples:
- Advertisements for products or services you didn't ask about
- Promotional emails from companies you've never heard of
- Mass newsletters you never signed up for
The intent is usually to sell something. Spam is annoying and clutters your inbox, but it's generally not designed to harm you directly. Most email clients filter it automatically into a Junk or Spam folder.
Delete it. Don't buy anything advertised in unsolicited email, and avoid clicking "unsubscribe" links from senders you don't recognize — that can confirm your address is active, leading to more spam.
Phishing
Phishing is a targeted attempt to trick you into revealing sensitive information — passwords, credit card numbers, Social Security numbers, or company credentials. Phishing emails impersonate a trusted source (your bank, Microsoft, a coworker, or even the IT department) to appear legitimate.
Common examples:
- An email that looks like it's from your bank asking you to "verify your account"
- A message appearing to be from IT asking you to reset your password via a link
- A fake invoice or package delivery notice with an attachment to open
- An urgent message from a "colleague" asking you to wire money or share login credentials
The intent is to steal information or install malware. Unlike spam, phishing is deliberately deceptive and can cause serious harm — to you personally and to the company.
Do not click any links or open attachments. If the email claims to be from a legitimate organization, go directly to their official website (don't use the link in the email) or call them using a number you know is real. Report the email to IT.
Quick Comparison
| Spam | Phishing | |
|---|---|---|
| Goal | Sell something | Steal information or credentials |
| Tone | Promotional | Often urgent or alarming |
| Impersonates someone? | Rarely | Almost always |
| Direct harm potential | Low | High |
| What to do | Delete it | Report it to IT |
A Note on "Spear Phishing"
Regular phishing casts a wide net — the same email goes to thousands of people. Spear phishing is a more targeted version where the attacker researches you specifically and crafts a message that feels personal and convincing. It might reference your name, your manager, a real project, or a recent company event. These are becoming the more common method, where someone's email is compromised, the attacker sees that they correspond with you, and then craft an email to you in a way that makes you more likely to open it and follow any links or instructions.
If an email feels off—even slightly—trust your instincts and verify through another channel before taking any action. Using a known-good phone number is the best bet. Don't correspond via email if you think the sender's email account is compromised!
When in Doubt, Report It
If you're unsure whether an email is spam, phishing, or legitimate, don't guess—report it to IT. It's always better to flag a false alarm than to miss a real threat. Use the Phish Alert button in Outlook to report it to the helpdesk.