Where bulk messaging stops being outreach and becomes spam

Almost every messaging scam you will ever receive arrives the same way: from a number you do not know, carrying a message you did not ask for, sent to you and to a great many other people at the same time. Understanding how that last part works makes the rest much easier to spot.

Bulk messaging is the practice of sending one message to many phone numbers in sequence, usually with a tool that prepares the list and opens each conversation in turn. It is not illegal, it is not exotic, and it is a normal feature of ordinary utility apps.

How the tools actually work

They are simpler than most people imagine, which is exactly why they are everywhere.

Espresso, a small iPhone utility, is a fair example of the honest end of the category. Its single-message screen takes a country code, a phone number and a message, then opens the conversation. Its second tab does the same thing for a list: enter several numbers separated by commas, verify them, write one message, and the app steps through opening each conversation in turn.

Note what is not happening. There is no contact list being harvested, no account, and no automated sending — the app opens each conversation and a person presses send. The underlying mechanism is a documented one: WhatsApp publishes click to chat, where a link containing a number in full international format opens a conversation whether or not the number is saved.

That is worth stating plainly, because the instinct to treat these tools as inherently shady is wrong and unhelpful. A shop confirming twelve delivery slots is doing something completely reasonable.

So what separates outreach from spam?

Consent, and nothing else. Not volume, not tooling, not intent as the sender describes it.

Espresso's own listing says it directly: use the multi-send feature responsibly, and only contact people who expect to receive your message. That is the correct rule, and it is the one every platform enforces.

Nobody who legitimately has your number needs to explain how they got it. Anyone who does is telling you something.

The four checks that hold up

When a message arrives from a number you do not recognise, four questions settle it faster than examining the wording.

• Did I start this? A message about a delivery, a payment or an account you did not initiate is unsolicited, whatever it claims. This single question resolves most cases.
• Is the ask reversible? Legitimate businesses do not need a code from your phone, a payment in gift cards, or an app installed to "verify" you.
• Does the identity survive contact? Look the company up yourself and call the number on their website. Never the number in the message.
• Would a real sender need urgency? Manufactured deadlines exist to prevent the first three checks.

The reason these work on bulk messaging specifically is that scale forces generic content. A message written for ten thousand recipients cannot reference your actual order number, your branch, or the name of the person you dealt with. Vagueness is not sloppiness; it is a structural requirement of the format, and it is the crack in every one of these campaigns. Our phishing coverage finds the same tell in email.

What the platforms do about it

More than people assume, and it is why the scam economy relies on churn.

Unsolicited bulk messaging breaches the terms of every major platform, and numbers that generate reports get restricted or banned. Using a third-party tool does not change this — the platform sees the messages, not the app that composed them. That is why fraud operations cycle through numbers constantly, and why the number that messaged you last month is often already dead.

It also explains a pattern worth recognising. A campaign that has to keep replacing numbers cannot build a reputation, so it can never look like an established business over time. If a "company" only ever contacts you from numbers that stop working, you are looking at the churn.

If you are the one sending

The rule is not complicated, and getting it wrong costs you the number your customers reach you on.

Message people who are expecting it: existing customers, confirmed orders, replies to enquiries. Identify yourself in the first line. Keep lists current and honour removals immediately. And send from a number you can afford to explain, because a restricted business line is a serious problem.

The reputational cost is the one people underestimate. A customer who receives an unexpected marketing message from a shop does not think about consent frameworks — they think the shop is careless with their details, which is the impression that survives long after the message is deleted. That is the same trust arithmetic we describe throughout our fraud prevention writing, and it applies to honest senders just as much as it does to the other kind.

The three campaigns this shape produces

Bulk messaging supports a small number of recognisable scripts, and knowing them shortens the recognition time considerably.

The first is the notification: a delivery is held, a toll is unpaid, an account is suspended. It works because everyone is waiting for something, and the message costs nothing to send to people who are not. The tell is that you cannot match it to a specific order or account you actually have.

The second is the wrong number. A friendly message apparently sent to the wrong person, an apology when you reply, and a conversation that continues for days before money is ever mentioned. Bulk messaging is what makes it economical — thousands of openers sent, a handful answered, and only those get a human's attention.

The third is the opportunity: a job, a task that pays, an investment a friend of a friend is in. It arrives cold, which is the whole giveaway, because real work is not distributed by unsolicited text.

All three share one property: they cannot survive a verification you perform yourself, through a channel you chose. That is why the advice to look the company up independently is not generic caution — it is the specific counter to a message written for thousands of people at once, and it is the habit we return to across our online scams coverage.