How does a spam filter decide what is spam?

Answer first

A spam filter decides whether each new email goes to your inbox or your spam folder. It looks at clues such as the words, the sender and the links, and gives the email a spam score. If the score is over a line, the email is moved. No line is perfect, so it sometimes gets it wrong.

In one line: A program that scores each incoming email and moves the ones that look like junk or scams out of your inbox.

Last reviewed: 25 October 2026 3 min read

What decision does it make?

Every time an email arrives, the filter makes one yes-or-no choice: is this spam? Spam means junk mail nobody asked for, and it includes scams that try to trick people.

Decision	Possible answers
Is this email spam?	Yes: move it to the spam folder. No: put it in the inbox.

What does it look at?

Content. The filter scans what the email says for patterns that look like spam.
Sender. Spammers can fake a sender address, so the sender is a clue but not proof.
Links. Many scam emails ask you to click a link, so a link is a clue worth checking.
Past examples. The filter compares each new email with emails already labeled spam or not spam.

How does it learn the rule?

Collect examples. Emails are labeled as spam or not spam. Each labeled email is one example.
Find the clues. The program looks at the clues in each example, called features, and at its label.
Score new emails. The program gives each new email a score for how likely it is to be spam.
Set the line. People choose the score that counts as spam. Emails above the line are moved.

Where can it go wrong?

A real email goes to spam. A school newsletter that says "pizza day" can look like an ad.
A spam email gets through. Scammers keep trying to outsmart spam filters, so some spam still reaches the inbox.
No line is perfect. Move the line down and more real mail is caught. Move it up and more spam gets in.

Try it

Toy example with made-up scores: move the line until as few emails as possible end up in the wrong place. Can you get zero mistakes?

Toy example: ten made-up emails, an invented spam score for each one, and whether it really is spam.

Item	Values	Right bin
You won a phone! Click now	Spam score: 95	Spam folder
Your account is locked. Reply with your password	Spam score: 85	Spam folder
Cheap watches, 90% off today only	Spam score: 80	Spam folder
Final notice: claim your prize	Spam score: 70	Spam folder
Class newsletter: pizza day!	Spam score: 60	Inbox
Hi! See my photos here (strange link)	Spam score: 55	Spam folder
Your order has shipped. Track it here	Spam score: 45	Inbox
Your library book is due Friday	Spam score: 35	Inbox
Photos from the weekend	Spam score: 25	Inbox
Practice moved to 5 pm	Spam score: 10	Inbox

Check it

What does a spam filter decide?

Answer: Which emails are spam. It makes one choice per email: spam or not spam.

You move the line lower. What happens?

Answer: More real mail is caught as spam. A lower line catches more spam, but also more real emails.

How does a filter learn what spam looks like?

Answer: From emails labeled spam or not spam. Labeled examples give it something to learn from.

For older readers

This is a classification problem. The filter is a model trained on labeled examples (spam or not spam) that outputs a score. The line is called a decision threshold. Catching real mail by mistake is a false positive; letting spam through is a false negative. Choosing the threshold is a trade-off between the two: moving it cuts one kind of mistake and adds more of the other.

Questions

Its clues added up to a score over the line. No line is perfect, so a filter sometimes catches real mail.

A filter is a program, not a person. It checks the clues in each email automatically to give it a score.

Some spam is only annoying. Some is a scam that asks for passwords or money. Never reply with a password, and ask a grown-up if an email feels wrong.