Reaching targets, the wrong way

laura
Industry
June 13, 2017

I’ve been increasingly annoyed by these drip automation campaigns. You know the ones I mean. Senders use some software to find some flimsy pretext to send a mail. Then there emails drop every few days. Sometimes this cycle goes on for months. Most of these messages violate CAN SPAM. It’s annoying. It’s illegal. It is spam.
I can even opt out of most of these messages, they don’t offer that ability.

Spammers Gonna Spam

I have so many examples of these emails. They’re all the same, really. They start out with a statement someone is reading my website. Then they mention they have an article that they or their customers wrote. This article is, of course, perfect for my site and the article.
Well that’s the theory anyway. They tend to miss the mark pretty significantly.
There was this one example where the company found a post linking to a newspaper article.

Hi there,
I was just browsing Word To The Wise and saw you were interested in travel from this post (https://wordtothewise.com/2011/01/fines-for-not-honoring-unsubscribes/). So I thought you might also be interested in linking to a resource we put together on how travelling can improve your health.
Here is a link for your review:

This example is the first in the second series of emails from Eric. He’s changed his email address and got my name wrong on this round, but otherwise this is identical to the messages he sent me in late May. I can even predict the cadence. Three days after the first messages, I’ll get a “hey, did you get my email?” On the fourth and fifth days the message will change a bit. By day 7 he’ll start asking for the “right person” at my company.

Hey Lauren –
I hope everything is going well on your end 🙂
I just finished going through your article here: https://wordtothewise.com/2015/04/a-series-of-tubes/. Thanks for the resource!
My colleague Lavanya put together a pretty comprehensive piece on the net neutrality just last week.There is a lot of info out there about net neutrality, and it’s sort of a hot topic at the moment. Our guide was designed to cut through the noise a bit.
The article is here: [link removed]
Would you consider linking to it in the post of yours I mentioned above? I saw you linked to en.wikipedia.org in there, so I figured I’d see if you’d link to mine as well. Perhaps your visitors find it helpful, but hey, it’s up to you.
Thanks,- Eric
P.S. I respect the relationship you have with your readers, I wouldn’t ask you to link to anything I didn’t think was an excellent resource for your site.

B2B spam is still spam

I was recently contacted by one of the software companies that provides infrastructure for these types of emails. Surprisingly, they are having a difficult time getting their mail delivered. It seems no one wants their mail. The thing is, I can’t help them. No one can help them. They’re sending mostly unwanted mail. I’m sure even the bloggers who make their money from blogging hate these kinds of messages.
This was someone building software that is causing significant amount of annoyance. I get the messages this software company, and their competitors, are facilitating. I am not going to help their spam get through to people who don’t want it.
During the call, they did name some of their competitors and I fell down the rabbit hole of B2B spamware. The vendors go through all sorts of contortions to convince their users this isn’t spam. Many of the phrases used on the websites were the same I heard on the phone. It’s one-to-one mail. It’s targeted. It’s focused on the recipient. It’s important.
Guess what? I’m a frequent recipient of that kind of mail. I know the mail isn’t targeted and it’s not focused on the recipient. The two examples above show that clearly. One of them couldn’t even get my name right! Both of them missed the context of the links and posts. None of this has to do with me or my readers, other than an example of what not to do.

CAN SPAM applies

The above examples aren’t anything special, I picked out the first two I saw in my mailbox. I have dozens of examples of these campaigns. In almost every case the messages violate CAN SPAM. Very rarely they’ll include an opt-out link, but they almost never include a physical postal address. Sometimes they include an opt-out, but they almost never have a physical address.

CAN SPAM says nothing about bulk, it only mentions commercial email. Specifically the act says:

The term “commercial electronic mail message” means any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service (including content on an Internet website operated for a commercial purpose).

It’s clear to me that the messages I’m getting are commercial. CAN SPAM applies. They need to have a physical address and an opt-out link for every message. They don’t.

Unwanted mail doesn’t reach the inbox.

Last week’s phone call demonstrated I am not alone in hating this mail. The software company contacted me for help because they can’t get to the inbox. It seems no one wants their mail. Due to blocking problems many of the senders resort to tactics used by spammers. They use different domains for their unsolicited mail. Sometimes they’re analog or cousin domains, like a .co for the unsolicited messages and a .com domain for their response emails. In other cases, they use Office365 or Google apps or Gmail for their outbound mail stream. Most places won’t block @gmail.com, so it’s a fairly safe to use gmail addresses.

Some of the messages are upfront about their marketing strategy using the Gmail. Let’s be clear, this strategy is a way to avoid spam filters.

Permission is key to delivery

Marketing programs that rely on spammer tactics are doomed to failure long term. Mail sent without permission does not work, even in the B2B space. Companies relying on unsolicited email discover it’s not that simple. Spam filters block unsolicited email. That’s their job, it’s what they’re designed to do. The way they detect unsolicited varies, but filters target unsolicited email.
There are large companies, many of them clients of mine, who do get caught in filters, usually because some of their mail is unsolicited. This isn’t intentional. Their overall program is sending mail to people who have asked for it and want it. Permission is a central piece of the email strategy. But, particularly as programs age, we find grotty corners where permission is a little iffy. These are small parts of their database, but they can cause significant problems.
Good email marketers know that permission is key. They invest time, energy and resources into getting permission and maintaining data. They think long term. They know recipients don’t want spam and that any gains from spamming are fleeting.

If I can't tell, it's spam

Judging by the amount of B2B spams I’ve gotten this past week, a number of businesses got bright, shiny new email programs for Christmas. “Like to set up a call with you…” “Just need 10 minutes of your time to explore…” “Love to jump on a call and tell you about our product…”
That’s just the mail that comes into my personal address. There’s also a raft of mail coming into our contact address. The majority of those are trying to sell me FB or Twitter followers, although Instagram is rising in the ranks. Some of those messages are kinda funny, though. They try so hard to pretend there’s a real person who really did look at our website and who really has a comment.
Most of the time it’s pretty obvious that it’s not from a human. But every once in a while a message comes in that might be from a real person. I’ve finally decided that if I have any question if a message was written by a human or a bot, it will be treated as written by a bot.
Unfair? Maybe. But I’m a small business owner and a consultant; I don’t have tons of spare time to sit around letting folks pitch me on their business. I don’t think I’m actually that unusual when it comes to entrepreneurs. We’re busy, we don’t like distractions and we go out and search for the things we actually do need.

Disappearing domains

On May 31, British broadband provider EE discontinued service for a number of email domains: Orange.net, Orangehome.co.uk, Wanadoo.co.uk, Freeserve.co.uk, Fsbusiness.co.uk, Fslife.co.uk, Fsmail.net, Fsworld.co.uk, and Fsnet.co.uk.
These domains were acquired by EE as part of multiple mergers and acquisitions. On their help page, EE explains that the proliferation of free email services with advanced functionality has led to a decrease in email usage at these domains.
Yesterday, Terra.co.br announced they were discontinuing email to a number of their free domains as of June 30, 2017: terra.com, terra.com.ar, mi.terra.cl, terra.com.co, terra.com.mx, terra.com.pe, terra.com.ve, and terra.com.ec.

I’m not surprised to see these domains going away and I think we’ll see more of it going forward. The reasons are pretty simple. Mail is not an easy service to run. Mail doesn’t bring in a lot of money. Dedicated mailbox providers do a great job and the addresses from them are portable.

Shibboleet

Using unique addresses for signups gives me the ability to track how well companies are protecting customer data. If only one company ever had an address, and it’s now getting spam or phishing mail, then that company has had a data breach. The challenge then becomes getting the evidence and details to the right people inside the company.
In one case it was easy. I knew a number of people inside the company and knew they would take it seriously and pass it on to the folks in the best place to deal with it. I did. They did. They got their systems secured and notified customers and it was all taken care of.
Other cases aren’t as easy.
Many years ago I got mail from my credit card company to a unique address. This was long before SPF or DKIM and the mail contained links different from the company’s main domain. I called them up to see if this was real or not. They told me it wasn’t, because tier 1 support are trained to tell users everything is suspicious. Eventually, though, it became clear this wasn’t a phish, it was just bad marketing by the company.
A few years ago I reported a possible breach to representatives of a company while at a meeting. Coincidentally, the address only their company had started getting phishing and spam during the conference. I brought it up to them and followed their directions for reporting. They asserted the leak wasn’t on their end, but to this day I get multiple spams a day to that address. They claimed that the spammer was someone I was friends with on their website, but they could never quite demonstrate that to my satisfaction. I treat that site as only marginally secure and take care with the information I share.
After Target was breached they emailed me, out of the blue, to the address I use at Amazon. There was some level of partnership between Amazon and Target and it appears Amazon shared at least part of their database with Target. I talked with security folks at Amazon but they told me they had no comment.
Of course, on the flip side, I know how challenging it is to sort through reports and identify the ones that are valid and ones that aren’t. When I handled abuse@ we had a customer that provided a music sharing program. If a connection was interrupted the software would attempt to reconnect. Sometimes the connection was interrupted because the modem dropped and a new person would get the IP address while the software was trying to reconnect. This would cause a flood of requests to the new person’s computer. These requests would set off personal firewalls and they’d contact abuse to tell us of hacking. There wasn’t any hacking, of course, but they’d still argue with us. One of my co-workers had a nickname for these folks that was somewhat impolite.
We had to implement some barriers to complaints to sort out the home users with personal firewalls from the real security experts with real firewalls that were reporting actual security issues. So I get that you don’t always want or need to listen to J. Random Reporter about a security issue.
Sometimes, though, J. Random Reporter knows what they’re talking about.

Yeah, I spent the morning trying to get support at a company to connect me to security or pass a message along. Too bad there isn’t a security shibboleet.