12% of e-mail users have actually tried to buy stuff from spam
Be honest: have you ever responded to a spam e-mail? Do you know anyone who has? If you're like most of us at Ars, you can't fathom why anyone would respond to most of the messages we get, but a new study released …
Context & Ripple Effects
This 12% figure lands on top of a body of 2008 research that approached spam from the money side: researchers who infiltrated the Storm Worm botnet to watch purchases flow through its affiliate system, and a follow-up study on how spammers actually convert clicks into cash. Those efforts inferred conversion rates from inside the machine; this survey measures the buyers themselves, and the number is far higher than most users would guess.
The pickup by Technology Review alongside Ars suggests the finding traveled as the missing demand-side data point in an argument that until then had been built almost entirely from botnet telemetry — evidence that the spam economy's customer base is not hypothetical.
First-order effects
- The study gives anti-spam advocates a concrete rebuttal to 'just delete it' complacency: one in eight e-mail users has at least attempted a purchase, meaning the audience sustaining spam operations is ordinary users, not a fringe.
- For the botnet operators profiled in last year's profit-tracking work, the figure validates the affiliate-payment model that keeps their pipelines stocked with product offers.
Second-order effects
- ISPs and filter vendors can now price their defenses against a quantified conversion pool rather than anecdote — every fraction of a percent of delivered spam maps to real attempted transactions, strengthening the case for aggressive filtering at the gateway.
- Legitimate e-commerce and e-mail marketers face a trust problem the number sharpens: with 12% of users demonstrably willing to buy from unsolicited mail, distinguishing sanctioned commercial mail from spam becomes both harder and more commercially urgent.
Third-order effects
- If a persistent single-digit-to-low-double-digit share of users keeps responding despite two decades of public warnings, spam remains economically self-sustaining regardless of filter improvements — pointing toward a structural arms race where enforcement and authentication standards matter more than user education.
- Measurement itself is becoming the battleground: the shift from inferring profits via hijacked botnets to surveying users signals a maturing research agenda aimed at the demand side of an economy regulators have mostly attacked on the supply side.
The trend: Spam research is shifting from supply-side telemetry about botnets toward measuring the buying behavior of ordinary users that ultimately funds the whole operation.