Spam vs phishing: what's the difference?

Spam and phishing overlap, but they describe different problems. NIST defines spam as unwanted bulk messaging, while its phishing definition describes fraudulent solicitations that impersonate a trusted source to obtain sensitive information. A promotional blast can be spam without being phishing. A credential-stealing email is phishing whether it targets one person or thousands. Purpose and deception, not volume alone, separate them.

What is the difference between spam and phishing?

Spam describes how a message is distributed and received: it is unsolicited, unwanted, and commonly sent in bulk. Phishing describes the sender's purpose. The sender pretends to be trustworthy and tries to obtain credentials, money, sensitive information, or another action that harms the recipient.

This distinction also separates this page from the broader guides to what spam email is and what phishing is. Those pages explain each category in depth. Here, the task is deciding which label fits a message.

Use intent before volume

Start with the requested action. A sales email you never requested may be spam. A message that leads to a fake login page is phishing, even if only one person received it. Send that same credential-stealing lure to a large list, and the message can fit both categories.

This decision object keeps the overlap visible:

message_classification:
  unsolicited: true
  sent_at_scale: unknown
  impersonates_trusted_source: true
  requested_action: "enter credentials"
decision:
  spam: possible
  phishing: true
  reason: "Deception establishes phishing; bulk delivery is not required."

spam: possible is intentional. Without delivery-volume evidence, phishing is clear while spam remains unresolved.

When spam and phishing overlap

The definitions are not mutually exclusive. Applying the two NIST definitions together, a deceptive campaign sent indiscriminately at scale is both spam and phishing. That is an inference from the definitions, not a separate category published by NIST.

The reverse does not follow. A promotional message can be unwanted and sent in bulk without impersonating anyone or asking for sensitive information. It can still violate policy or law, but the spam label alone does not establish phishing.

Sender appearance does not settle the question either. Email spoofing can support a phishing attempt, but an attacker can also use a lookalike domain or a compromised account. A message may be technically authenticated and still deceptive, which is why passing SPF or DKIM does not prove a message is safe.

What should you do with a suspicious message?

The FTC advises against using contact details inside an unexpected message to verify it. Contact the supposed sender through a website, phone number, or account you already trust.

Do not open an unexpected attachment or follow a link just to investigate. Report the message through your organization's security process or the phishing-reporting option provided by your mailbox service. Delete it when that process allows. If someone already disclosed information or opened a harmful file, follow your incident-response process instead of treating the message as ordinary junk.

Check the public controls on a domain you manage

If you manage the domain shown in suspicious mail, use the Email Security Score to inspect its public email-security records and find domain-level configuration gaps.

Check the domain's email security score

The score reads public DNS records. It cannot classify an individual message as spam or phishing, prove a sender's intent, or inspect its headers and links.