Opening a spam email almost never hacks you. What hacks you is the step after: the click. That is where your attention belongs. My service, AliasFleet, hands every site its own forwarding address, and every week I watch people get this backwards. The open terrifies them, though it cost them nearly nothing. Then they relax, click the link, and that is the part that costs them everything.
This piece covers the opening only. What happens when the message renders. What the sender learns. What they never get.
The click is where it goes wrong
Start with the dangerous part, because everything else only makes sense next to it.
A spam link usually drops you on a login page wearing your bank's colours, your mail provider's logo, or a shop you trust. You type your credentials in. The attacker collects them on the spot and walks straight into your real accounts. CISA describes the same shape: phishing pushes people toward clicking malicious links, opening harmful attachments, or handing over confidential information. The ATSSA summary of CISA's advice puts the two main payloads in plain terms, credential theft through realistic-looking login pages and ransomware through harmful file downloads, and its advice runs three words per step: recognise, resist, delete.
Attachments follow the same pattern. Open one and it can plant malware, including keyloggers that record every keystroke and ransomware that locks your files. Your click set it off.
Look at the scale. The FBI's Internet Crime Complaint Center counted 193,407 phishing complaints in 2024, with reported losses over $70 million from phishing schemes specifically and $16.6 billion across all internet crime categories, per the figures quoted by LegalClarity. Opening produced none of it. Everything after opening produced all of it. Hold onto that split, because the rest of this article hangs on it.
So here is the rule worth your attention: click nothing inside a message you do not trust. No links. No attachments. No buttons. The open was the cheap part. The click is the expensive part.
What opening a message actually does
Your client treats a message as something to display, not something to run. That single fact explains most of this article.
Email looks like a web page, but it is not one. A web page can run scripts. An email cannot, in any mainstream client. Most email clients do not support JavaScript due to security concerns, and they either strip out the script or block the email altogether, per beehiiv's guide to JavaScript in email.
Open a message and the client shows text and pictures. It reads the HTML, lays it out, and pulls in whatever remote images the message points at. It runs none of the sender's programs. It installs nothing. Reading the text in an email is normally fine, and the risk arrives when you interact with the message, per Clean Email's breakdown of the question.
The preview pane counts as opening. If the message renders there, the same image fetching happens.
The sender's message is data your client displays, not code your device executes. The dangerous objects in a message are the ones that wait on your action: the link you follow, the attachment you open.
An attachment that stays closed is inert. The risk starts when you open it, because then the file runs, or asks your reader or office program to run something, or asks you to enable macros. A link sitting in a message is text. The risk starts when you follow it to a page built to capture credentials or drop a download.
The one case that breaks the rule
Only one case on record breaks this rule, and skipping it would make this article less trustworthy. Microsoft patched CVE-2023-23397 in March 2023. The flaw let a crafted message fire on its own the moment Outlook pulled it in, ahead of any Preview Pane view, and hand NTLM credential hashes to a server the attacker ran. CERT-EU's advisory records a Russia-based actor using it from April to December 2022 against European government, military, energy, and transport organisations, and notes that Microsoft 365 online services escaped it because they do not support NTLM authentication.
Keep that in scale. Patched since March 2023. Aimed at a handful of high-value targets by a state-linked actor, never blasted through bulk spam. A client bug, not how opening mail normally works.
The practical lesson is the usual one: keep your mail client and your operating system updated. The patch closed this hole. An unpatched client stays exposed to the next one.
What the pixel learns, and what it does not
A tracking pixel rides along in nearly all spam and marketing mail. Picture a one-pixel image you cannot see, carrying an address made just for you. When your client pulls it in, the sender's server notes the fetch, and that note becomes the "open" on a dashboard somewhere. Your address is live, and somebody looked. Our guide to email tracking covers the whole mechanism.
How much rides along with that fetch depends on your client. Blanket claims go wrong right here.
Classic Outlook blocks automatic picture downloads by default, which blocks the pixel outright. Microsoft's support page on blocking picture downloads calls tracking pixels out by name, as invisible images that can tell a sender you have read the email.
Apple Mail takes another route. Mail Privacy Protection pulls remote content in privately through Apple relays and hides your IP, so the sender cannot reliably tell whether or when a person opened the message. The pixel may still fire as a machine open before any human reads it. SendGrid's guide to Mail Privacy Protection describes how Apple fetches content often before the user opens a message. MakeUseOf's iPhone privacy walkthrough gives the setting path, Settings then Apps then Mail then Privacy Protection then Protect Mail Activity, and notes the protection does not stop tracking if you tap a link inside the email.
Gmail sends remote images through Google's own proxy servers. The tracking server sees Google infrastructure, not your device. IP address, location, and device details stay masked, but the open event itself can still register. Gmail also withholds images when it judges a sender or message suspicious. Google's own wording stays hedged: senders "may" know whether you opened an email that has an image, per Gmail's help page on images. The Suped explainer on Gmail's image proxy confirms the proxy hides device, IP, and location behind Google infrastructure.
So opening can confirm your address is live. It hands over no files, no passwords, and no control of your device.
Take the value out of the confirmed address
The pixel confirms the address is live. That confirmation only has value while the address stays in use everywhere.
The address you have used everywhere for a decade is the hard version of this problem. It already sits in breach dumps and broker lists. Our piece on where spammers get your address covers those supply lines. You cannot unshare it. You can stop feeding it to new sites.
Hand each new site its own email alias instead of your real address. The alias forwards to your real inbox, and the site never holds the address you actually live in. When spam lands on one alias, the To field names the source, because only one site ever had that address. Our leak-tracing guide walks through that mechanism, and the set-up guide takes about two minutes.
Then, when an alias starts receiving spam, pause it. Mail stops at the door. Your real address stays clean and your other aliases keep working. The opened message already did its worst: it confirmed one address is live. Pausing that address drains the confirmation of value.
Aliases cover the future. Every new signup gets a traceable address, and every noisy sender gets an off switch.
Turn the pixel off in your client
You can take the pixel away from the sender entirely. Three settings, one per client, and they cost nothing.
In Apple Mail, check that Protect Mail Activity is on: Settings, then Apps, then Mail, then Privacy Protection. For no pixel event at all, use Block All Remote Content, which stops external images loading unless you approve them per message.
In Gmail, choose "Ask before displaying external images" in Settings, then See all settings, then the General tab, then Images. Gmail will show a "Display images below" prompt on each message instead of loading pictures automatically. The Live2Tech walkthrough covers the web, Android, and iPhone steps, and notes that choosing Ask also turns off dynamic email.
In classic Outlook, leave automatic picture downloads blocked, which is the default. If you already turned downloads on, switch the block back on in File, then Options, then Trust Center, then Trust Center Settings, then Automatic Download. The Microsoft support page linked above gives the exact steps.
Our Gmail spam guide covers the report, block, and filter tools that sit alongside these settings for the mail you already receive.
If you already opened one
An open on its own keeps the damage to a live-address signal, and the steps below close it off.
Bin the message and empty the trash. Flag it as spam or phishing in your client, which trains the filter without telling the sender anything new.
A clicked link or typed credentials changes the job: change that account password right away from a device you trust, and switch on two-factor authentication if it is not already on. If that password lives anywhere else, change it there too.
An opened attachment means a full scan with your security software, and pull the device off the network first if the scan finds something or the device starts behaving strangely.
Then check the address at Have I Been Pwned, and switch on its breach notifications. If the opened address was an alias you gave to one site, pause that alias and move on. If it was your real address, used everywhere, start the per-site habit now: the next open will confirm an address you can kill, not the one you live in.
You were not hacked by opening a spam email. The click is still there, waiting. Leave it alone and the worst of today is a spammer knowing one address is live. Pull that address away and even that stops counting.
Top comments (0)