A stranger has landed in your inbox. You have never heard of them, they have no connection to you, and their message arrives with no context at all. Almost always, it is one of four things. A typo, someone else using your address, a sold list, or a scam. I run AliasFleet, an email-alias service, and the address a message arrived on is the fastest way I know to sort them out. Hand every site its own alias and misdirected mail gives itself away.
This is triage for a single message. It is not a fix for an inbox that filled with junk overnight, which has different causes, different fixes, and its own write-up in our guide to sudden spam spikes. Here the question is smaller: one message, one stranger, and what it is.
Four kinds of stranger mail
A typo. Somebody tried to reach a person whose name looks like yours and typed your address instead. Dots confuse people here, because they look like they should matter. Google says dots do not change a Gmail address, a rule that covers consumer Gmail, which means a dotted version of your name still lands in the same inbox. Dots are not why you got someone else's mail. When the rest of the address matches yours, the sender mistyped something else or meant a different person whose address is nearly identical.
Someone else using your address. Some signup forms take whatever address gets typed and never check it belongs to the person typing it, so account mail for a complete stranger starts arriving. Order confirmations, booking reminders, school newsletters. Usually it is a slip. A finger lands in the wrong place, a field autofills badly, and suddenly you are getting someone else's life in your inbox. It can be deliberate too, because an address that looks plausible sails straight through a form that never verifies. Either way the mail is real. A real service sent it to the wrong person, and that person is you.
A sold or shared list. Your address passed along a chain of companies you never dealt with, and now marketing mail turns up from senders you have never heard of. It fits your life uncomfortably well. Offers close to things you actually buy, from brands you never contacted. That targeting is the giveaway, and the trade behind it is a whole story of its own, which our guide to how spammers get your address follows from start to finish. For triage, the tell is simple: marketing mail from a stranger, no account behind it, nothing asked of you.
A scam. This one dresses up as a company you might trust, a bank, a delivery firm, a streaming service, and then asks you to click, log in, or hand over details. The FTC counts email as the top method scammers used to reach people in 2024. Urgency does the pushing. An account about to close, a parcel held back, a refund waiting to be claimed, all engineered to make you move before you think. Treat any stranger mail that wants an action as guilty until the checks below clear it.
A 30-second triage
Run three checks, in this order. First, the To line: did this come to your address, to an alias you recognise, or to a name that is not you? Second, what it wants. Real misdirection wants nothing from you, while a scam wants a click, a login, or details. Third, the sender. Ignore the display name and read the actual domain behind it, because the name is the easiest part to fake. In Gmail, open the message, click the three dots beside Reply, and choose Show original. The headers show the path the message took and the sender details, and when the domain in the From line does not match the domain in the routing, treat the message as a scam.
Never reply to find out whether a strange message is real. Never click a link or an unsubscribe button to test it. Replying tells a scammer the address is live. An unsubscribe click in scam mail does the same thing, and the official advice follows the same shape: recognise, report, delete. These checks read the mail without engaging with it.
| What arrived | Most likely kind | What to do |
|---|---|---|
| Mail for a stranger, from a real service, asking nothing | Typo | Delete it, and tell the sender only if it is plainly a genuine mistake |
| Account mail for a stranger, orders, bookings, school lists | Someone else using your address | Leave confirm and reset links alone, then delete it |
| Marketing mail from a company you never dealt with | Sold or shared list | Report as spam, and unsubscribe only if you once joined that list |
| Mail demanding a click, a login, or details, dressed in urgency | Scam | Report as phishing, then delete it |
How aliases make misdirected mail obvious
An email alias is a forwarding address you hand to one site and only that site. Your real address never enters the exchange. So mail on the alias you gave to one shop comes either from that shop or about that shop, and there is no third option.
That turns triage into a glance. Mail on an alias you gave to a bookshop, talking about a parcel you never ordered, is either the shop's mistake or somebody using that alias at the shop. Mail on an alias you never gave the sender is misdirected by definition. Mail that reaches your bare address wearing a stranger's name is a typo or somebody else's signup, because you never handed that address to anyone. The leak-tracing mechanism is the same idea pointed at breaches: the To line names the source.
Setting this up takes minutes, and our setup guide walks through the whole thing. It will not stop stranger mail arriving. What it does is label every message with where it came from, before you even open it.
What to do about each kind
A typo. Delete it. When the mail is plainly a genuine mistake, a school newsletter, a booking confirmation, a club mailing list, you can tell the sender they have the wrong address. Google's own advice for mail meant for someone else is to notify the sender. Do not forward the contents with your correction. The sender does not need your copy of somebody else's mail.
Someone else using your address. Leave confirmation and password-reset links alone, no matter how official the mail looks or how urgent it claims to be. A confirmation click can verify an account you never opened and tie it to your address. A reset link can hand you the keys to a stranger's account, which is a mess you do not want. Delete the mail. If the same stranger's mail keeps coming from one service, contact that service through its own site and tell it the address is wrong. One exception: a reset for an account that is actually yours, which you did not ask for. Go to that site yourself, never through the mail, and check the account. If the mail points to accounts opened in your name, bills, collection notices, cards you never applied for, that is no longer misdirected mail. The US government's identity theft guide lists the warning signs and the reporting steps.
A sold or shared list. Report it as spam instead of replying. In Gmail, blocking a sender sends its future mail to Spam, and blocking does not unsubscribe you. Unsubscribe only for a list you once joined. Gmail's subscription manager lists active subscriptions in one place, and our guide to unsubscribe links draws the line between safe and risky clicks.
A scam. Report it as phishing, then delete it. The FTC's advice for an unexpected message is blunt. Do not click links or download attachments in it. If it might be real, reach the company through a contact you already know is genuine, never through the message itself, because the message is the thing you cannot trust. Forward phishing mail to reportphishing@apwg.org and delete it. When a message claims your address leaked, check it yourself with Have I Been Pwned and our guide to checking whether your email was leaked, rather than trusting the message. A spoofed sender can wear any display name. Phishing built on leaked email is exactly this shape: a real-looking message, aimed at a real address, asking for one wrong click.
What aliases cannot fix
Aliases do not stop mail already aimed at your bare address. That address is in dumps and lists already. No forwarding setup reaches back in time to scrub it. They do not prove a sender is real, either. A scammer who gets hold of one of your aliases can mail it, and the To line will still show that alias, because the alias only records where the mail was aimed. The alias tells you where the mail was aimed, not who sent it. And they do not replace reporting. A scam reported is a scam the filters learn from, while a scam merely deleted teaches nothing at all. If the mail turns out to be breach fallout, our breach-response guide covers the password and lockdown steps.
Most stranger mail is boring. A typo, a stranger's signup, a list sale. The dangerous kind announces itself the same way every time: it wants you to act now, through its own link. Check the To line, check what it wants, check the sender, then deal with it and move on.
