How do spam filters recognize unwanted messages?

1. Leo opens his messages. Grandma wrote, and so did his coach. But the third one, from a stranger, shouts that he has won a prize. That is junk mail, also called spam.
2. Before any message reaches Leo, the mail service passes it through a spam filter. Messages that look fine go straight to the inbox.
3. The filter scans for clues. Who sent this? A stranger. A prize that is too good to be true. Words that rush you. A strange link. Each one is a warning sign.
4. Each clue adds points to a score. This message scores ten points, far above the cut-off, so the filter drops it into the junk folder.
5. Sometimes junk slips through. When people press the report button, the filter learns from it, and next time it catches messages like that one.
6. No filter is perfect. A good message can land in junk, and junk can reach your inbox. So if a message looks odd, do not click it. Show a grown-up.

Tap each part of the filter. Watch what it does when you find it.

• Sender check. First the filter checks who sent the message. People in your contacts are trusted. Senders that many people have reported are not.
• Clue scanner. The scanner reads the message, looking for clues such as prizes, hurry-up words, strange links and requests for secrets.
• Score meter. Every clue adds points. The meter shows the total score. If it reaches the cut-off, the message counts as junk.
• Sorting flap. The flap sends each message one of two ways: to your inbox or to the junk folder.
• Inbox. Messages that pass the filter arrive in your inbox. Most are fine, but a sneaky one can still slip in, so stay careful.
• Junk folder. Junk waits in this folder for a while and is then deleted. A grown-up can look here if a real message has gone missing.
• Learning memory. The filter learns from people. Each time someone reports junk, it remembers the clues and gets better at spotting them.

Make the filter relaxed, balanced or strict. Tap any message to read its clues. Which setting makes the fewest mistakes?

Experiment: What happens when you make a spam filter as strict as you can?

1. Choose Relaxed and count the junk that reached the inbox.
2. Choose Strict and count the good messages in the junk folder.
3. Try Balanced. Tap the messages marked as mistakes and read their clues.

What we found: A relaxed filter lets junk slip into the inbox. A strict filter stops all the junk, but it also throws away good messages that happen to have a clue, like the library's hurry note. A balanced filter makes the fewest mistakes, and still not zero. That is why a grown-up sometimes checks the junk folder.

Turn on JavaScript to try it yourself.

Sort 8 made-up messages using their clues. You may make 2 mistakes. For 3 stars, make none.

Spam is a message that is sent to huge numbers of people who never asked for it. Some spam is just annoying advertising. Some is a trick: it tries to make you click a link, or to give away a password or other secret. A spam filter is a program that checks every message before it reaches you and moves the junk out of the way.

A filter works like a detective collecting clues. Who sent the message: someone in your contacts, or a stranger? Does it promise a prize you never entered for? Does it rush you with words like now and hurry? Does it have a strange link, or ask for a password? Each clue adds points, and a message with many points goes to the junk folder.

Nobody types all those clues in by hand. Filters learn them. Every time a person presses the report button, the filter gets one more example of junk, and every time someone rescues a good message it learns that too. With millions of examples, it finds out which words, links and senders usually mean trouble.

A filter is like a sieve, but a sieve only checks size, and a filter has to guess. So it makes mistakes both ways: now and then junk reaches the inbox, and a good message lands in junk. That is why you are the last check. If a message looks odd, do not click anything, never share a password or your address, and show it to a grown-up.

Key words

Spam

Junk messages sent to lots of people who did not ask for them.

Spam filter

A program that checks each message and moves the junk away from your inbox.

Phishing

A trick message that pretends to be someone you trust so that you give away a secret.

Score and cut-off

The filter adds up points for clues. At the cut-off number, a message counts as junk.

False positive

A good message that the filter put in junk by mistake.

False negative

Junk that the filter missed, so it reached the inbox.

Check your thinking

1. A message from a stranger says you won a prize and must click a link right now. What should you do?

   Show the answer

   Do not click, and show it to a grown-up. A stranger, a prize, a hurry and a link are four clues at once. Never click. A grown-up can check it safely.

2. How does a spam filter decide that a message is junk?

   Show the answer

   It adds up points for clues, and a high score means junk. Clues such as an unknown sender, a prize or a strange link add points. Enough points and the message is filed as junk.

3. Your friend's party invitation is missing. Where might it be, and why?

   Show the answer

   In the junk folder, because filters sometimes make mistakes. A good message with a clue or two, such as a link, can be caught by mistake. Ask a grown-up to check the junk folder.

4. How does a filter get better at catching new kinds of junk?

   Show the answer

   It learns from the messages people report as junk. Every report is an example. With millions of examples the filter learns which clues mean trouble.

5. Two messages have exactly the same clues. One is from a real relative with a new address and one is from a stranger. What does this show?

   Show the answer

   A filter that sees only those clues cannot tell them apart, so a careful person is still needed. A filter works only with the features it can measure. When they are identical it must guess, which is why you check with an adult before trusting a message from an unknown address.