Conclusions of McAfee’s Global S.P.A.M. Diaries Project

McAfee‘s S.P.A.M. experiment ran in April 2008. Fifty volunteers in 10 countries answered every spam message and pop-up for 30 days, and between them they received more than 104,000 spam emails. Its main conclusions still hold in November 2026: spam isn’t going away, it is closely tied to phishing and malware, and replying to real spam or “unsubscribing” from it only brings more. What has changed is the scale and the defences. Kaspersky counted spam as 44.99% of global email traffic in 2025, text messages became the most common way scammers reached people who filed FTC fraud reports, and since 2024 Gmail and Yahoo (and Microsoft since 2025) have required bulk senders to authenticate their mail with SPF, DKIM and DMARC.

How the S.P.A.M. experiment worked

A post on the eROI blog linked to a story with a hard-to-ignore title: “What Happens When You Reply to ALL of Your Spam.” It sounds like madness at first. Who would sign up for that, or have the time, given how much spam arrives every day? The story turned out to be one volunteer’s diary from an experiment run by McAfee.

The diary belonged to a housewife whose month started on April Fool’s Day 2008. The experiment was called Spammed Persistently All Month (S.P.A.M.), and the rule was simple: answer every spam message and every pop-up on the computer for 30 days. McAfee gave each participant a clean laptop and a new email address. They then browsed without protection and visited sites most people would avoid.

You might ask who would want that laptop afterward, given the malware that probably came in with all that spam. The volunteers did notice their computers slowing down during the month, a typical sign of adware and other malicious software. That is a warning in itself.

McAfee wanted 50 volunteers from around the world for the Global S.P.A.M. Diaries project. The campaign had two main goals:

• To let users go where they would normally never go, and see whether tempting calls to action really were too good to be true
• To teach users how to spot spam emails and the risks that come with them

The numbers from 30 days of spam

The volunteers received more than 104,000 spam messages in 30 days. That works out to about 2,096 messages per person, or roughly 70 a day. The United States received the most by far, with 23,233 messages. Brazil came second with 14,856, according to coverage of McAfee’s results, which were released in July 2008.

What McAfee concluded

McAfee drew seven conclusions from the campaign. Each one is below, with a short note on where things stand today.

• Spam is still everywhere. Despite everyone’s efforts and precautions, spam remained a real threat that was growing fast. Once their addresses were on spam lists, the participants found it almost impossible to unsubscribe, and things got worse over time. Today: Kaspersky’s 2025 figures put spam at 44.99% of all email traffic worldwide. Clicking “unsubscribe” inside true spam still tends to confirm that your address is live.
• Spammers will try anything. The spam showed how much social engineering had grown. Messages used religion, death and sick children, or offered free products, cash and easy loans, all to scam people or steal data from individuals and businesses. The 2008 credit crunch made financial spam the most common type, and a fake Chase.com email was the most popular phishing lure. Today: The FTC reports that scammers still pose as familiar companies or people you know and push you to act right away.
• Spam and cybercrime are linked. Most participants received phishing emails within a short time, even though their addresses were brand new. That showed how dangerous spam can be, and why you should be careful about opening suspicious emails and about where you share your address online. Today: Kaspersky detected more than 144 million malicious or potentially unwanted email attachments in 2025, up about 15% on the year before.
• Non-English spam is growing. The spam came in more languages than McAfee expected, and people in different countries received different spam depending on where they lived. Local-language spam is harder to detect because filters see less of it. McAfee called foreign-language spam “an area to watch” as spam became more targeted and localized. Today: McAfee was right. Campaigns are now routinely regional, and Kaspersky’s 2025 email antivirus detections were led by Asia-Pacific (30%) and Europe (21%).
• Mobile spam hadn’t taken off yet. It wasn’t widespread in 2008, but many participants were asked to hand over their mobile numbers. McAfee predicted that mobile spam would soon grow as fast as email spam. Today: That prediction came true. The FTC found that people lost $470 million to text message scams in 2024, five times the amount reported in 2020. In 2025, text messages were the most common contact method in fraud reports where people said how the scammer reached them.
• People who know about spam still underestimate it. The participants came from all walks of life and all over the world. They volunteered because they already knew spam was a problem, yet all of them were shocked by how much they received in a short time and how far spammers would go. Today: The FTC says consumers reported a record $15.9 billion in fraud losses in 2025, up from $12 billion in 2024.
• There’s no such thing as a free lunch. However tempting an offer looks, it is almost always too good to be true.

Source: McAfee Global Spam Diaries

What has changed since 2008

The behaviour of spammers looks much the same. What has changed is how mailbox providers protect people and what they now expect from legitimate senders.

In February 2024, Gmail and Yahoo began enforcing rules for bulk senders, which Google defines as senders of about 5,000 or more messages a day to Gmail addresses. These senders must authenticate with SPF and DKIM, publish a DMARC record (at least p=none), offer one-click unsubscribe in marketing mail, honour unsubscribe requests within two days, and keep their spam rate below 0.3%. Microsoft added similar requirements for domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com, starting May 5, 2025.

The smallest DMARC record that meets the Gmail and Yahoo minimum looks like this:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

For legitimate marketers, the lesson from the experiment is the reverse of the spammers’ playbook. Send only to people who asked for your mail, make unsubscribing easy, and honour opt-outs quickly. CAN-SPAM already requires you to process opt-outs within 10 business days, and Gmail and Yahoo now ask for two.

The key takeaway: be careful what you click

The experiment’s advice still stands: be careful what you click. If you don’t recognise the sender in the “From” line, don’t act on the message. In 2026, simply opening an email in Gmail, Outlook or Apple Mail is much less risky than it was in 2008. The real danger comes from clicking links, opening attachments, replying, or giving out personal details. Remember that a display name can be faked, so check the actual sending address. When in doubt, mark the message as spam or phishing so the provider’s filters learn from it.

FAQ

Is it safe to click unsubscribe in a spam email?

If the sender is a brand you know and signed up with, it is generally safe, and Gmail’s own unsubscribe button is the safest way to do it. If the message is true spam from an unknown sender, don’t click anything inside it. McAfee’s volunteers found that unsubscribing from spam lists almost never worked. Use your provider’s “Report spam” button instead.

How much of all email is spam today?

Kaspersky measured spam at 44.99% of global email traffic in 2025. Gmail, Yahoo and Outlook.com filter most of it before it reaches your inbox. That is why the 70 messages a day McAfee’s unprotected volunteers received is far more than a typical filtered inbox sees.

Can opening a spam email infect your computer?

In current versions of Gmail, Outlook and Apple Mail, just opening a message rarely causes harm. Scripts don’t run, and remote images are proxied or blocked. The risk comes from attachments, links to fake login pages, and replying, which confirms that your address is live. Keep your mail app and operating system up to date.

What are the Gmail and Yahoo bulk sender rules?

Since February 2024, senders who send around 5,000 or more messages a day must authenticate with SPF, DKIM and DMARC. They must also offer one-click unsubscribe in marketing mail and keep their user-reported spam rate below 0.3%. Microsoft applied similar authentication rules to Outlook.com, Hotmail.com and Live.com from May 5, 2025. Smaller senders should follow the same practices, because filters judge everyone by them.

Where should you report spam and phishing?

In your email app, use the “Report spam” or “Report phishing” option so the provider’s filters learn from the message. In the US, you can report scams to the FTC at ReportFraud.ftc.gov. Forward spam text messages to 7726 (SPAM) so your mobile carrier can block the sender.

How do legitimate marketers avoid being treated like spam?

Only email people who opted in, and never buy or scrape lists. Authenticate your domain and watch your spam rate in Google Postmaster Tools. Honour unsubscribe requests within two days, which is well inside CAN-SPAM’s 10-business-day limit. Be clear about who you are in the “From” line and the subject line, because those are the first things recipients check.

Sources

• Google Workspace Admin Help: Email sender guidelines and Email sender guidelines FAQ
• Yahoo Sender Hub: Sender best practices and bulk sender requirements
• Microsoft Tech Community: Outlook’s new requirements for high-volume senders
• Federal Trade Commission: CAN-SPAM Act: A Compliance Guide for Business
• Federal Trade Commission: How to Recognize and Avoid Phishing Scams
• Kaspersky press release: 15% growth in malicious email attacks in 2025
• Dark Reading: McAfee’s Great Spam Experiment, Unplugged