Scam watch: the email that offers to send your advert to millions of inboxes

An email offering to advertise your business to "MILLIONS OF EMAILS" is doing the rounds among UK businesses. Copies dated 23 and 31 October carry the same subject line: "Advertise to MILLIONS OF EMAILS - The best deals today". It promises an "Immediate SALES BOOM!" and asks the reader to get in touch on WhatsApp, Telegram or Microsoft Teams.

It is not a real marketing service. It is spam selling more spam, and paying for it can cost a business its money, its email reputation and possibly a fine. Here is how it works and how to protect your business.

What the email looks like

The email is short and shouty. The tell-tale signs:

• A random sender. The sender name is a jumble of letters, and it is the same as the sender address.
• Domains with no link to advertising. One copy comes from the mail server of a maritime college in Indonesia, another from an unrelated .com website. Those organisations are most likely victims whose servers or accounts are being misused, not the people behind the offer.
• Replies go elsewhere. The "reply to" address is a free Gmail address, not the sending domain.
• Huge, vague promises. It claims your advert goes to "up to 200 million emails", with results you can watch on an "Exclusive Online Panel". It even offers to write the advert "at no extra cost".
• Chat apps only. Contact is by WhatsApp, Telegram or Microsoft Teams, using a mobile number with a Brazilian country code. There is no website, company number or address.
• Leftover settings. At the bottom sits a stray line of technical text: a mail server name, a port number and the word "socks5". It looks like settings left behind by the bulk-mailing tool, suggesting the mail is pushed through a proxy to hide its real origin.

One copy fails every basic email check (no SPF, DKIM or DMARC) and is flagged as spam. The other carries a digital signature from the college's own server, a reminder that a passed check only proves which server sent an email, not that the sender is honest.

How the scam works

1. The email goes out through someone else's server. The anti-spam group Spamhaus explains that criminals guess weak passwords, use fake login pages or plant malware to take over accounts on genuine mail servers. They then use those accounts to send spam, sometimes for weeks or months.
2. Replies are moved onto chat apps, where there is no company to look up and no paper trail.
3. A "package" is offered: a number of emails, the countries to target and a free advert.
4. The buyer pays up front. After that, the seller can simply go quiet.
5. Any adverts sent go out the same way: likely from hijacked servers, to people who never agreed to hear from the buyer.

How the scammers make money

• The upfront fee is the profit. Sending through other people's servers costs the sender very little, so almost all of the fee is kept.
• Nothing can be checked. The "online panel" is the seller's own dashboard. A buyer has no way to prove how many emails went out, or whether any did.
• Replies have value too. Every reply confirms that a real person reads that inbox, which makes the address more useful to anyone sending spam.
• The buyer carries the risk. Under the UK's PECR rules, marketing emails to individuals, including sole traders and some partnerships, need consent that names your business. The Information Commissioner's Office (ICO) says there is no such thing as a third-party marketing list that meets the "soft opt-in" rule. In January 2026 the ICO fined a Bristol company £105,000 for sending more than 67 million marketing emails without valid consent, and said it had not done enough checks on the third-party data it used.
• Your domain can be blocklisted. Spamhaus keeps a Domain Blocklist of domains used in unsolicited bulk email. If your website address appears in spam, mail from your normal business address can start landing in junk or being refused.

How to spot it

• An advertising offer that arrives as spam is selling spam.
• Random letters as the sender, and a domain with no link to the offer.
• Replies go to free webmail, and contact is by chat app only.
• Huge numbers, free extras and no company details.

How to protect your business

• Don't reply or message the number. Delete the email.
• Tell your team, especially whoever handles marketing or the general inbox.
• Never buy or rent email lists. Only email people who chose to hear from you, through a known email platform with real delivery reports.
• Protect your own email accounts. Use strong, unique passwords and turn on 2-step sign-in, so your server does not become the next one sending this kind of mail.
• Watch your sent mail. If your domain sends email you did not write, ask your provider to check for a hacked account.
• Report it. Forward the email to the National Cyber Security Centre at [email protected]. It is free, and the NCSC says it acts on every report.

If you replied, paid or shared details

1. Stop all contact. Block the number and use the report option inside WhatsApp or Telegram.
2. If you paid, contact your bank or card provider straight away. Use the number on the back of your card or on their official website, and ask them to treat it as fraud.
3. Report it to Report Fraud at reportfraud.police.uk, the national service that replaced Action Fraud in December 2025 (England, Wales and Northern Ireland). In Scotland, report it to Police Scotland.
4. If you shared logins, passwords or files, change those passwords and turn on 2-step sign-in.
5. If anything was sent in your name, ask your email or hosting provider to check whether your domain is blocklisted.

A real email marketing service has a website, a company you can check and a contract. An offer from a random address that wants you on WhatsApp has none of those.