“We have your event’s attendee list”: why you should never buy it

If you’ve ever booked a stand at a trade show or conference, you’ve probably had the email. It usually arrives within days of your name appearing on the exhibitor list, and it reads something like this: we have the attendee list for your upcoming event, with thousands of verified contacts, available at a special price if you reply today.

It’s tempting. You’ve just spent thousands on a stand, and here’s someone offering you the very people who’ll walk past it. But that list almost certainly isn’t what it claims to be, and buying it can cost you far more than the asking price.

What the email looks like

These emails follow a pattern that’s remarkably consistent across shows and countries. Here are two real examples published by the organisers they impersonated.

In 2022, the American Association of Orthodontists shared an email its exhibitors had received. The subject line started with “RE:”, as if it were a reply to something you’d sent. It claimed to have 16,365 verified contacts for the meeting, priced at $1,792, signed only by a “Marketing Coordinator” (AAO). The same year, a pitch for “HIMSS Attendee Mailing Lists” offering 46,467 contacts for $1,928, with “updated lists every 25 days”, was blasted so widely it even landed on a public Linux developers’ mailing list (LKML archive).

Look closely and you’ll see the same tell-tale signs:

• A suspiciously exact number of contacts, and an oddly precise price.
• “RE:” in the subject of an email you’ve never seen before.
• No real company details: a first name, a job title and a free or odd-looking email address.
• An invitation to reply “leave out” or “unsubscribe”, which mostly confirms your address is live.
• Payment by bank transfer or PayPal only, often with a “no refunds” policy.
• A sample of four or five contacts, which may well be real people scraped from a public website.

Is it ever the real list?

Almost never. Reputable organisers don’t sell their attendee lists, and many say so in plain terms. RX, which runs dozens of UK shows, states that its visitor database “is confidential information and is not sold or made available to third parties” (All-Energy). International Confex at ExCeL London calls the senders “hoax” companies and asks exhibitors not to reply (International Confex). The Association of Anaesthetists issued a statement making clear it does not sell or authorise any sale of its lists, and described the problem as sector-wide (Association of Anaesthetists).

So where do these “lists” come from? Usually from data scraped from the web, old databases relabelled for each new event, or nothing at all. Back in 2016, staff at the security industry publication IPVM were offered an “official” attendee database for a major American security conference. Looking into it, IPVM concluded it was most likely harvested data relabelled for the event, and walked away (IPVM).

What happens if you pay

The best documented account comes from TSNN, the trade show news network. In 2019, an events technology team collected more than 300 of these solicitation emails in six weeks. One colleague paid $700 for what she believed was the attendee list for a medical show she was exhibiting at. What arrived was around 15,000 doctors’ records. They looked real enough, but they weren’t the show’s attendees. Refunds were refused, and taking legal action across borders wasn’t worth the cost (TSNN).

That’s the usual outcome. Either nothing arrives, or what arrives is a generic list that has nothing to do with your event, and your money is gone.

The bit nobody mentions: data protection

Even if a list were genuine, using it could land you in trouble. In the UK, emailing people for marketing is governed by the Privacy and Electronic Communications Regulations and UK GDPR. The Information Commissioner’s Office is clear that the “soft opt-in”, which lets you email people you already have a relationship with, does not apply to new contacts from bought-in lists (ICO). Sole traders and some partnerships count as individuals, so they need to have given consent.

The responsibility sits with whoever sends the emails, not whoever sold the list. A seller’s promise that everyone “opted in” won’t protect you. The ICO has fined companies heavily for sending marketing emails using third-party data they hadn’t checked properly, including a reported £105,000 fine for one firm that sent more than 67 million emails relying on other people’s data (emailexpert, ICO).

And there’s the reputational side. Attendees who get unsolicited emails after a show often assume the organiser sold their details. That’s unfair on the organiser, and it doesn’t make your brand look good either.

What to do when you get one

1. Don’t reply. Not even to say no or to unsubscribe. Replying tells them your address works, and you’ll get more.
2. Don’t click any links or open attachments.
3. Forward it to the organiser. Most shows have an exhibitor services address, and some ask for these emails specifically so they can warn others.
4. Check the exhibitor manual. If the organiser offers a genuine lead scanning or matchmaking service, it will be listed there, and it will come with proper consent.
5. If you’ve already paid, contact your bank or card provider straight away, and report it to Report Fraud (the service that replaced Action Fraud) at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.

It helps to know you’re in good company. Many organisers say exhibitors receive dozens of these emails before every show. The ones who get caught out aren’t foolish. They’re busy people, under pressure to make a big investment pay off, being sold something that sounds sensible.

Better ways to meet the right people

If what you really want is more of the right visitors on your stand, there are honest ways to get them. Ask the organiser about sponsored emails sent to opted-in attendees, matchmaking or meeting services, and lead scanning on the day. Invite your own customers and prospects with the free passes most shows give exhibitors. These reach real people who’ve agreed to hear from you, which is worth far more than a spreadsheet of strangers.

If you organise events

You can’t stop these emails being sent, but you can make them far less effective. Say clearly, on your website and in your exhibitor manual, that you never sell your attendee list. Give exhibitors a simple way to check a suspicious offer with you. And find out whether your real list has leaked: hiding a few made-up contacts in each copy you share is a simple way to know for certain where a leak came from.

The scammers rely on silence and uncertainty. A clear message from you, sent early, is the best defence your exhibitors have.

This guide is general information, not legal or financial advice. If you have lost money, contact your bank straight away and report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (in Scotland, Police Scotland on 101).