What’s the risk of buying lists?

The risks stack up in a way that makes purchased lists look cheap on the surface and expensive in practice. Here's what you're actually buying.

Spam traps. Lists that get bought and resold accumulate spam traps: addresses that exist specifically to catch people sending to lists they shouldn't have. Hitting one (especially a pristine honeypot trap) can cause an immediate blocklisting with no warning. Your ESP may suspend your account if they detect spam trap hits in your sending.

High bounce rates. B2B email addresses decay at roughly 20-30% per year. A list that's been compiled, sold, and resold over 12-18 months will have a significant percentage of invalid addresses. Hard bounces above 2% are a red flag to mailbox providers. Above 5%, you're looking at sender reputation damage that takes weeks to recover from.

Spam complaints. People who didn't sign up to hear from you are more likely to mark your email as spam than reply. One spam complaint per 500 sends is generally the safe threshold. Purchased lists routinely exceed this, especially if the contacts have been contacted by many previous buyers of the same list.

Legal exposure. Under GDPR, you're responsible for the legal basis of the data you hold. Buying a list doesn't transfer consent. If the original data source didn't have valid consent, you've inherited that liability. For EU contacts, this is a genuine compliance risk, not just a theoretical one.

If you've already bought a list and want to salvage value from it, validation before sending is the minimum. Our list validation catches spam traps, invalid addresses, and high-risk contacts. Send only to what passes. It won't eliminate the consent problem for EU contacts, but it will reduce the deliverability damage for everyone else. Start with a free sample validation to see what you're working with.