Spammers create their potential target lists by scanning online forums, newsgroup postings, stealing mailing lists from others, searching websites or Internet Relay Chat sites for email addresses. The gathering of such information is facilitated by automated software packages or robots, which have been designed for spamming across different Internet service environments. As bandwidth cost is reduced, some spammers now use a tactic called the "dictionary attack", in which emails are sent to guessed email addresses. Again, this can also be done with automated software.

Do not reply or complain by simply clicking the reply button. Most likely, the reply address is forged. If you reply to that email address, or to the ISP that provides the spammer's email address, you are more likely being tricked by the spammer into wasting your time (and the victim ISP's time) by complaining to the wrong party. Seek help from your ISP if you want to find out the real person sending you the spam emails.

Unless you are confident that the organization sending out the spam email is trustworthy, do not send out any unsubscribe request . Most likely, such a request is either ignored or worse, used as a confirmation that your email address is valid and operational, exposing you to yet more spam in the future.

Yes. One of the most effective ways to control spam emails is to use protective software known as filters. While you cannot stop people from sending out spam emails to you with anti-spam filters, you can stop the messages from showing up in your inbox and have them deleted automatically. Filters allow you to easily block any email messages carrying a specified address, domain, subject, or text from being deposited in your inbox. Some popular email programmes already offer spam-filtering features. A number of separate filtering tools that work with popular email packages are also available on the market. However, filters may sometimes fail to identify spam emails, or, though at a much lower possibility, classify legitimate emails as spam emails.

If you suspect that someone is selling or using harvested address lists, you should report it to the Office of the Communications Authority (CA). CA will investigate and may prosecute against the seller or user. If your computer has been hacked and exploited by someone to send out spam emails, you should also report the incident to CA. CA will collate reports and may transfer the case to the Hong Kong Police where applicable.

If you suspect that the sender is contravening any rules for sending commercial electronic messages, you may report this to CA.