Where Spam Calls, Cold Emails and Junk Mail Actually Come From

The spam calls arrive from numbers you do not recognise. Whoever is on the other end already knows your title, your employer and often the name of someone you report to. The junk mail brings approaches from wealth managers, property agents and charities you have never contacted, addressed to you personally at a home address you have taken some care not to publish. Somewhere between three and ten cold emails a week land on a direct line that perhaps a dozen colleagues use. The targeted advertising that follows you between unrelated sites appears to know the size of your household and roughly what your house is worth.

Most people file all of this under nuisance, which individually is the right filing. Blocking a spam number takes a moment, unsubscribing takes two and the letters go in the recycling on the way back from the front door. What makes it worth more than a moment’s irritation is the shape of it rather than any single message. The approaches keep coming, they arrive from directions that have nothing to do with one another and they get conspicuously worse in the weeks after particular events in your life.

That timing is worth following, because it is the part that gives the game away. The systems generating this contact are not watching you personally. What they watch are the registers, the filings, the announcements and the title records. You appear in those on a schedule that has nothing to do with how careful you have been with your privacy settings.

Why the calls increased after a promotion, a house move or a company filing

The events that move the needle are ordinary and almost all of them are announcements: a new role, a promotion, a company registration, a funding round, a house purchase, a board appointment, the sale of a business. Each of them writes something down in a place other people are permitted to read. Each triggers a refresh in commercial systems built to spot exactly that kind of update.

This is why the increase feels like a burst rather than a drift. The underlying exposure may be several years old and entirely unchanged, but a record that has just been updated is a record that sells. Freshly updated records are the ones worked through first.

The three kinds of database behind cold calls, recruiter emails and junk mail

It is convenient to describe all of this as one industry, as most writing on the subject does. The approaches reaching you are generated by at least three distinct businesses that buy from different places, select on different fields and refresh on different signals.

The first is the people-search sites. They deal in consumer records, which is to say your name, your current and previous addresses, your age, your telephone numbers and the names of your relatives. This is the layer almost everyone has already met, because it is the only one of the three built to be looked at. Its entries are searchable by anyone who types a name into a box. That is why it is what people find when they go looking for themselves, and why it absorbs nearly all of the attention.

The second is the B2B contact databases, sometimes sold as sales intelligence, which recruiters and sales teams subscribe to. They sell professional identity. Their selectors are your job title, your seniority, your employer, your reporting lines and a telephone number that reaches you without passing a switchboard. The firms operating here are not secretive about their methods and set them out plainly in their own material: collection from the web at scale, reconstruction of organisational charts, contact details contributed by users in exchange for credits and databases acquired when one company buys another. A record in a sales-intelligence database describes a role rather than a person, together with a route to whoever currently occupies it. That is why it updates when you change jobs rather than when you move house.

These databases price their records by seniority, because a route to somebody who can authorise a decision is worth more than a route to somebody who cannot. Effort follows expected return, which is most of the explanation for where this contact concentrates. A director, a founder or an executive is also named in filings, registers and announcements that most employees never enter. That places the same person on lists built from sources with no connection to their employer.

The third is the wealth-screening lists, which select on assets. They are the least discussed of the three, even though they generate the contact people find most unsettling. Lists sold into private banking, wealth management, property and philanthropy are segmented on the value of your home, the number of properties you hold, the type of car you drive, whether an aircraft or a vessel is registered in your name, whether you appear as an investor in a private company and whether you have given to a cause before. The sources behind those fields are different again: title aggregators, corporate filings, public registries and published donor rolls. None of it requires your email address to function. That is why the wealth-screening lists are the ones that reach you by post.

The overlap is where this becomes practical. One person can sit on all three kinds of list at once, indexed under different identifiers, updated by different events and sourced from places with no commercial relationship to one another. That explains the observation clients raise more than any other. After they take action, approaches of one kind stop while approaches of another kind carry on exactly as before. The difference looks arbitrary until you know which database the opt-out reached and which ones it never touched.

Why opting out did not stop the calls

The natural response to discovering any of this is to go and remove yourself from it. Most of the people who reach us have already tried. The results tend to disappoint them, for reasons that have more to do with visibility than with effort.

Consumer listings can be inspected. You can search for yourself, see the entry and follow whatever process the site publishes, which makes the work legible even when it is tedious. The B2B contact databases and the wealth-screening lists do not behave that way. Their holdings are not published, there is no page to look yourself up on and somebody outside those companies cannot establish from open sources which of them holds a record describing them. We hold to that limit in our own work, documenting what can be observed and declining to assert what cannot.

So the database people successfully address is reliably the one they could see. The other two continue, refresh at the next announcement and produce contact the reader has no way of tracing to a source.

Why a standard opt-out list misses the databases that hold you

Published success rates are the natural thing to reach for at this point. They cannot tell you what will happen in your case, for reasons that sit in how they are produced.

A service measures itself against its own coverage list, recording a success when a source complies with a request and also when the source turns out to hold nothing about you in the first place. Those two outcomes are not separable in the published figure. A service concentrating on sources with straightforward processes and thin holdings can therefore report a very high rate without having moved anything that mattered. The denominator was chosen by the vendor rather than by your circumstances.

The only denominator that describes your situation is the set of sources that actually hold something about you. That set was settled by your own history: where you have lived, what you have registered, which announcements name you, what stands in your name. No coverage list was assembled to match it. The lists do not even match one another: across the ten services examined in one peer-reviewed study, only ten sources appeared on every list.

So requests go out to places that never held anything about you, while places that do hold something are never contacted, because nobody put them on the list you bought. Both failures happen at the same time, without either appearing in the reported rate.

Independent testing bears this out from the other direction. When Consumer Reports compared paid services against people working through the same fixed set of sites by hand, the people doing it by hand came out ahead. That comparison means something precisely because the list was fixed and common to every arm of the test, which is the condition the vendors’ own figures lack. Working by hand is slow and repetitive. It carries one structural advantage no subscription reproduces: the person doing it is working from the sources that hold them, rather than from a list drawn up for somebody else.

This is the same reason monitoring tends to disappoint. A monitoring service watches the sources you handed it. Nobody approaching you is confined to that list.

The practical consequence is an ordering rather than a technique. Establishing which sources hold you is the step that determines whether any of the work lands, rather than preparation for it. We set out how the paid services compare with each other in our review of whether data broker removal services actually work.

When unsolicited contact becomes a security problem

Nearly all of this contact is lawful and most of it is merely tiresome, but the edge of it is worth naming. The same record that lets a recruiter reach a direct line lets somebody else open a conversation with accurate context, which is what makes an approach credible. When an approach demonstrates knowledge that does not fit its stated source, the question has stopped being one of nuisance. The same public material also tells an attacker when to make the approach.

Which databases hold you depends on your own history

The question we are asked at this stage is almost always which sites to opt out of. Answered generically, it produces the results described above.

Which sources hold you follows from facts particular to you. A founder who has registered three companies and sold one is exposed through filings. A director who has moved house twice is exposed through title records. Somebody promoted into a role that gets announced is exposed through the announcement and through everything downstream that reads it. Those are three different sets of sources, three different refresh triggers and three different pieces of work. No list assembled in advance describes any of them.

There is a reason this is worth doing rather than tolerating. Somebody whose time is expensive cannot simply ignore unknown numbers, because a proportion of unknown callers are people they need to speak to. Every one of them therefore carries a small decision. Multiplied across the volume described above, what this costs is attention rather than patience. Attention is the part of an executive’s day that cannot be bought back.

Establishing what is actually held, and where, is what makes everything after it targeted. It is also the part the evidence supports: the approaches that work are the ones aimed at sources that genuinely hold something.

Sources

1. Grauer, Y., Kauffman, V., Honeywell, L. “Data Defense: Evaluating People-Search Site Removal Services.” Consumer Reports, 8 August 2024. Full report (PDF). 32 volunteers, seven paid services plus a manual control, measured against 13 people-search sites over four months.
2. He, J., Snyder, P., Haddadi, H., Bustamante, F. E., Tyson, G. “Measuring the Accuracy and Effectiveness of PII Removal Services.” Proceedings on Privacy Enhancing Technologies 2025(4), 166–182. doi:10.56553/popets-2025-0125. Coverage-overlap figures drawn from the ten services surveyed.