How Junk Mail Gets to Your Office (And How to Stop It)

If your office mailbox fills up with catalogs, coupon books, and “Current Resident” flyers you never asked for, the standard advice is to register with a few opt-out services and call it solved. That advice is genuinely useful, and worth doing — but it skips the question most business owners never think to ask: how did the marketers get your address in the first place? For a growing share of businesses, the answer traces back to the same place email harvesting bots have been targeting for years — the company website.

How Big the Junk Mail Problem Actually Is

Before getting into the source, it’s worth establishing scale. According to U.S. Postal Service figures, marketing mail — the official category covering catalogs, credit card offers, coupons, and promotional flyers — accounted for 57.5 billion of the 112.5 billion total pieces of mail sent in 2024. That’s roughly 51% of everything that moved through the postal system that year, generating over $15 billion in revenue for USPS from advertisers alone. This isn’t a fringe annoyance affecting a handful of unlucky addresses. It’s a majority share of all mail volume in the United States.

The Part Standard Advice Skips: How Marketers Get the Address

Every guide to stopping junk mail covers the same well-worn ground: register at DMAchoice.org, opt out of prescreened credit offers through OptOutPrescreen.com, contact Catalog Choice, write “refused, return to sender” on unwanted envelopes. These steps work, and they’re worth doing. But they all share the same blind spot — they manage your presence on lists that already exist. None of them address how your office address ended up on those lists to begin with.

For a business with a public-facing website, the answer is often more direct than people assume. Wikipedia’s documentation of email harvesting techniques describes a specific, named tactic called “e-pending” — appending additional contact details to an existing direct-marketing database. The conventional version works like this: a direct marketer already has your business name and street address from a public source — a business directory, a trade publication, a permit filing — and searches the web specifically to find a matching email address to add to that record.

Regulators Have Documented This Exact Practice

This isn’t speculation about how scraping theoretically could feed physical mail lists — it’s been formally investigated and confirmed. France’s data protection authority, the CNIL, ran a series of inspections that found companies using web scraping software specifically to collect contact details from online public spaces for direct marketing purposes. The CNIL’s findings named two patterns directly relevant to any business with a public address listed online: companies that extract contact data from real estate listings and then sell the resulting databases to agencies and other marketers, and companies that scrape every business listed in an online directory for a given geographic area, building a complete regional contact database from publicly listed information.

The regulatory guidance is explicit on a point many business owners assume works the opposite way: contact details published in a public online space are still considered personal and protected data, even though they’re freely visible. Publishing your office address on your own website doesn’t waive your right to control how that address gets reused — it just makes the address easy to collect.

• 1
  CollectionAn automated scraper crawls your website’s contact page, footer, or About page and extracts your business name and physical address directly from the HTML.
• 2
  Appending or AggregationThe scraped address gets cross-referenced against existing records to fill gaps (“e-pending”), or combined with addresses pulled from dozens of other business websites into a new regional database.
• 3
  CategorizationThe database gets sorted by industry, geography, or business size — making it more valuable to specific advertisers, like a local print shop targeting every small office in a given zip code.
• 4
  Resale & ReuseThe finished list is sold to direct mail marketers, who print and send catalogs, coupon books, and flyers — and the same list often gets resold to other marketers, which is why the volume rarely comes from just one sender.

Why This Makes Opt-Out Tools an Incomplete Fix

The standard opt-out advice remains genuinely worth following — the FTC’s official guidance on registering with DMAchoice and OptOutPrescreen will meaningfully reduce the volume of prescreened credit offers and major catalog mailings a business receives. But these services share a structural limitation: they only remove your address from lists held by companies that participate in the opt-out system, and only for mail tied to your name through those specific channels.

None of the major opt-out services can reach a mailing list that was built independently by scraping your website — that list was never registered with DMAchoice, was never built from a participating data source, and the company running it has no obligation to check your opt-out status before adding a freshly scraped address. Independent research on junk mail reduction confirms the same gap from the consumer side: even after completing every standard opt-out step, persistent unaddressed mail and “Current Resident” flyers — exactly the category fed by scraped directory and address data — remains the hardest type to fully eliminate, because it isn’t tied to your name on any list in the first place.

The Same Pipeline as Email and Phone Harvesting

This is, structurally, the same problem email harvesting has always represented — a bot reads your website’s HTML, extracts a contact data point, and feeds it into a resale pipeline that compounds over time. The physical-mail version is simply less discussed, partly because the consequence — a flyer instead of a spam email — feels lower stakes, and partly because the connection between “I published my address online” and “I got a coupon book in the mail” is far less obvious than the connection between a contact form and an email inbox.

The broader data broker pipeline that resells scraped contact information doesn’t distinguish neatly between email addresses, phone numbers, and physical addresses — a scraping operation built to extract one contact type from a webpage is often built to extract all three from the same page in a single pass, since they typically appear together in a footer or contact section.

What Actually Closes the Gap

Given that opt-out services manage existing lists rather than preventing new ones from being built, the more durable fix is the same one that applies to email and phone harvesting: stop the scrape before it happens, rather than only managing the lists that result from it after the fact.

• 1

  Combine standard opt-outs with source-level prevention. Registering with DMAchoice and OptOutPrescreen still meaningfully reduces volume from participating senders — keep doing it — but pair it with protecting the address at its source.

• 2

  Encode or obfuscate your physical address the same way you would an email. If your business address appears in plain HTML on your contact page or footer, it’s exactly as exposed to scraping as an unprotected email address.

• 3

  Use active bot detection, not just hidden text. A scraper that’s blocked outright before it finishes crawling your site never gets the chance to extract your address at all — which is a stronger position than hoping an obfuscated address goes unnoticed.

• 4

  Audit your entire site, not just the contact page. A physical address can appear in old blog posts, press releases, or footer widgets across dozens of pages — manually fixing one contact page leaves every other instance exposed.

This is precisely the gap WhoKnew Shield™ is built to close. While Shield’s core focus is contact information broadly — email, phone, and physical address alike — auto-detecting and protecting all three across an entire WordPress site means a business’s office address gets the same dual-layer obfuscation and active scraper-blocking as its email address, rather than sitting exposed in plain HTML as the one contact type most site owners never think to protect.

Who knew the coupon book that showed up at your office this week probably started the same way the spam in your inbox did — a bot reading your website’s footer, months before the flyer ever got printed.