Can a spammer grab the addresses off an e-mail’s blind copy (Bcc)? Several people in my office insist it can be done.
Rest assured, the claim of insecurity is a legend that pops up from time to time. You can confirm its safety by sending yourself an e-mail (see screenshot below) and include yourself as a Cc (copy) and a Bcc (blind copy).
When it arrives, it looks like this:
When you send a message, names and addresses in the Bcc are automatically stripped out by the sending server (usually the Internet Service Provider) after they are transmitted so they are never available to the recipients.