I was recently messaged over a website of an online marketplace regarding an advertisement of an item I was selling, whereupon the "buyer" asked me to contact them over an email they provided.

After messaging that email, the reply I received was from a different email (spelled very similarly) e.g. emailed [email protected] to get a reply from [email protected] (actual emails have been changed). I did not notice this at first until the body of the email made me suspicious of a scam.

Why would the scammer not reply with the same email?

I had considered that the email may serve as a "listening" address, and correspondence was delegated to individual scammers. If this where the case, why not just ask me to contact the email they would have replied with, in the first place?

I had also considered that this may be to filter more scam aware people, but wondering if there was more to it.

  • 2
    A less nefarious explanation would be if they frequently have their name misspelled and simply registered both addresses, but (obviously) prefer to use the one where the name is spelled correctly. Another less competent but similar explanation is if their email client allowed them to misspell the outgoing address.
    – tripleee
    May 27, 2019 at 4:31

3 Answers 3


They might be load-balancing internally.

Let's say you are dealing with a team of 10 scammers who spam 10,000,000 people and assume that about 200 marks reply. How do they make sure those 200 marks are evenly distributed on their 10 people? By having them all reply to the same address and then distribute them internally. Whoever gets assigned to the mark then replies from their own email so all further correspondence goes through their personal mailbox.

Or they might even go a step further and give each mark an own mailbox to converse with so the scammers don't mix up their marks. A mark might suddenly reply from a different account or accidentally start a new email thread just mentioning "the deal we agreed on". When a scammer operates on multiple marks at the same time (and most scammers do) then they really don't want to be confused by that and risk breaking the illusion that the mark is in some unique negotiation with a private person.

  • I think this is the most likely answer. Balancing the load of marks that reply, not marks that you contact.
    – xyhu617
    Jun 28, 2019 at 0:31

I look at my spam box often and see this too. I think it has something to do with how scammers send emails in the first place.

Most spam/scam emails are sent by hacked accounts or botnets. In both cases, the scammer would have access to thousands or even millions of these accounts. Obviously they cannot keep track of emails going to each one. They instead probably setup a single account and ask each victim to send their emails there instead to easily keep track of.

Sending emails does not require any port to be forwarded, while receiving emails require certain ports to be open. For a botnet, listening on ports is hard and can lead to easier detection. Thus many of them might only be able to send emails rather than send and receive.

This doesn't explain why some of the addresses are similar, though, it could just be a coincidence.


It only proves that the correspondant is not a serious person but many things are possible:

  • the mailer program may contain an error in the outgoing address - in the SMTP protocol, the From: header may contain something unrelated to the envelope mail.
  • the user may have various addresses, and inadvertently used a different one on the second exchange
  • some users have a bunch of addresses, some for familly and friends, some for official sites, for example one for communicating with their ISP or their bank, and various ones dedicated for unsecure use, for example for communicating with an unknown site or mail. Those last ones are just destroyed if a lot of SPAM come on them. Your correspondant could have used one of them at first time and decided to drop it soon and because of that would use a different one.
  • you are facing a poorly programmed bot that uses random addresses from a pool

I really do not know which of those possibility is more likely real. All I know is:

  • a well programmed bot should always use the same address to communicate with the same mail
  • a serious professionnal should not change its address without an explicit message
  • polite behaviour would recommend to control that we always use the same address to communicate with same correspondant.

That being said, even serious persons can sometimes commit errors...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .