To file a CAN-SPAM complaint, go to ReportFraud.ftc.gov, describe the message, and paste in the sender’s address, the subject line, the full email headers, and the message body. The Federal Trade Commission won’t resolve your individual case or get you compensation, but your report enters a database that federal and state investigators use to build enforcement actions against the worst senders. The largest CAN-SPAM penalty the FTC has obtained was a $2.95 million settlement against Verkada in 2024, and cases like that are built from complaints filed by ordinary recipients.
Filing With the FTC
The FTC retired its old spam@uce.gov inbox years ago. The current route is the online form at ReportFraud.ftc.gov. Expect a short guided flow:
- Click the button to start a report and pick the category that best matches the spam or deceptive email you received.
- Enter the sender’s email address and the subject line of the message.
- Paste the full email headers. This is the single most important technical step, because headers reveal the actual origin server rather than the display name, which is often spoofed.
- Paste the message body so investigators can see deceptive claims, a missing unsubscribe link, or the absence of a physical mailing address.
- Review the summary and submit. The system returns a reference number confirming your report.
Your own contact information is optional. Providing it lets the agency reach you if your report becomes relevant to a larger investigation. Either way, the complaint enters the Consumer Sentinel Network, a secure database that civil and criminal law enforcement agencies across the country can search.
Getting the Email Headers
Email headers are the routing data behind every message: sending servers, IP addresses, timestamps, and authentication results. Without them, a complaint is your word against a display name that may be entirely fake. How you find them depends on your email client.
On a Desktop
In Gmail in a browser, open the email, click the three-dot menu next to Reply, and choose Show original. A new window shows the full header data, which you can copy.
In Apple Mail on a Mac, open the message and go to View > Message > All Headers. Select and copy the header text that appears at the top of the email.
In desktop Outlook, open the email, click File > Properties, and copy the contents of the Internet headers box at the bottom of the dialog.
On a Phone
Most mobile mail apps, including the default iPhone Mail app, don’t expose full headers at all. The Outlook app on Android can show them, but only after you install the Message Header Analyzer add-in from the three-dot menu inside a message.
The simplest workaround is to open your provider’s webmail on a computer, find the same message there, and pull the headers using the desktop steps above. Forwarding the message to yourself doesn’t help, because the forwarded copy loses the original routing data.
Reporting to Your Email Provider
Filing with the FTC is the formal route. Reporting to your email provider is often faster in practical terms. Most major providers accept spam reports at abuse@[their domain]. Forward the offending message with headers intact so the abuse team can act on real routing data. Confirmed violations can lead to the sender’s account being terminated or their IP addresses being blocked.
The Report spam or Mark as junk button in your mail app is worth using every time. Each click trains the provider’s filters and feeds the sender-reputation scores that determine whether that address ever reaches an inbox again. Federal investigations take months or years; provider-level action can stop a specific sender from reaching you within days.
Reporting Spam Text Messages
CAN-SPAM also directed the FCC to write rules for unwanted commercial messages on wireless devices. If the spam came by text, you have three options and they stack:
- Forward the message to 7726 (which spells SPAM). This goes to your wireless carrier, which uses reports to identify and block similar messages.
- Use the Report junk or Report spam option inside your messaging app.
- File the same report at ReportFraud.ftc.gov that you would for email.
You can also file with the FCC at consumercomplaints.fcc.gov and select Unwanted Calls/Texts as the phone issue. Like the FTC, the FCC won’t resolve your individual complaint, but it uses the data to shape enforcement.
Filing With Your State Attorney General
State attorneys general are the enforcement channel most people overlook. CAN-SPAM explicitly authorizes them to sue spammers on behalf of their residents when the sender uses fake header information, deceptive subject lines, ignores opt-out requests, or violates the sexually explicit email rules. Courts can award injunctive relief, actual damages, statutory damages, and attorneys’ fees. The FTC has the right to intervene in any state-level CAN-SPAM case, so state and federal action sometimes run in parallel.
Most state AG offices take consumer complaints through their websites. Filing there alongside your FTC report is worth the extra few minutes, especially if the sender appears to be targeting people in your state.
What Counts as a Violation
Before filing, make sure the message actually falls under the law. CAN-SPAM covers commercial email whose primary purpose is advertising or promoting a product or service. Common violations include:
- Fake or disguised “From,” “To,” or routing information.
- Subject lines that mislead about the email’s contents.
- No working unsubscribe mechanism, or one that still receives mail more than 10 business days after you asked to be removed. The opt-out link must keep working for at least 30 days after the email is sent.
- Unsubscribe processes that charge a fee, require a login, or demand personal information beyond your email address.
- No valid physical postal address in the message.
- No disclosure that the email is an advertisement, unless you previously agreed to receive messages from that sender.
Civil penalties can reach $53,088 per email. Criminal penalties, including up to five years in prison, apply when senders harvest addresses through automated tools or script the creation of fake accounts to send spam.
Emails the Law Doesn’t Cover
Transactional and relationship messages sit mostly outside CAN-SPAM. Order confirmations, shipping notices, warranty and product recall information, account balance updates, subscription status changes, and messages tied to a job or benefits plan you’re enrolled in don’t need to carry an unsubscribe link, an ad disclosure, or a physical address. The one rule that still applies to them is that the routing information can’t be forged.
A separate wrinkle: individual consumers cannot sue under CAN-SPAM. The private right of action is reserved for internet access service providers, and only when they can show actual harm from specific messages. For everyone else, enforcement runs through the FTC, state attorneys general, and, in certain industries, other federal regulators. Some state consumer protection or fraud laws that aren’t specific to email may support a lawsuit on separate grounds; CAN-SPAM doesn’t preempt them. If a deceptive email caused you measurable financial harm, an attorney can tell you whether a state-law claim is realistic.
What Happens After You File
The FTC doesn’t investigate every complaint individually. It uses pattern recognition across the Consumer Sentinel database to find high-volume senders generating large numbers of reports. When a sender crosses a threshold that justifies federal resources, the agency may open an investigation that can end in injunctions, consent orders, or civil penalties.
The Verkada settlement shows how this works in practice. The security camera company was accused of flooding prospective customers with commercial emails and ignoring unsubscribe requests, and the $2.95 million penalty in 2024 was the largest CAN-SPAM outcome the FTC has obtained. No single complaint drove the case; the volume of reports made the pattern visible.
The realistic playbook is to file everywhere the sender can be reported: the FTC for the national database, your state attorney general for potential state-level action, and your email provider for the fastest chance of getting the sender blocked. None of these guarantees a result on its own, but together they create overlapping pressure that makes it harder for a spammer to keep operating.