Stop the Calls, Part 16: the 10-business-day clock on broker emails

Subject: "RE: Your $250,000 approval - final notice." [EXAMPLE - illustrative subject line, not a real email] You never applied. There is no earlier email to be "RE" to. The phone got quieter after your written stop. Now the inbox is the dialer: four funding pitches before 9 a.m. [EXAMPLE - illustrative count, not real data] This is Part 16. Part 2 covered the written stop for calls (https://mcafax.com/notebook/stop-the-calls-part-2-written-stop-request) and Part 7 covered texts (https://mcafax.com/notebook/stop-the-calls-part-7-texts). Today: what email law says a sender owes you. Every part: https://mcafax.com/notebook/series/stop-the-calls General information, not legal advice.

What the email law says

The CAN-SPAM Act covers commercial email, meaning email that mainly advertises a product or service. The FTC says the law makes no exception for business-to-business email, so a funding pitch to your shop address counts: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business Under 15 U.S.C. 7704 (https://www.law.cornell.edu/uscode/text/15/7704), a commercial email must:

1. Not use materially false headers, or a subject line likely to mislead you about what is inside.
2. Clearly say it is an ad or solicitation, unless you gave prior affirmative consent.
3. Include a valid physical postal address.
4. Offer an opt-out that keeps working for at least 30 days after sending.
5. Stop more than 10 business days after your opt-out arrives. After you opt out, the sender cannot sell or transfer your address. The FTC rule adds a big one: a sender cannot charge a fee, require anything beyond your email address and opt-out choices, or make you do more than reply or visit a single web page to opt out (16 CFR 316.5: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316/section-316.5). The limits: CAN-SPAM is not a "no email" law. A sender can email you the first time without asking. And only the FTC, other agencies, state attorneys general, and internet access providers can enforce CAN-SPAM; individual recipients cannot (15 U.S.C. 7706: https://www.law.cornell.edu/uscode/text/15/7706). Your job is the record and the report.

The tactic: the 10-business-day routine

1. Check the footer for a company name, a postal address, and an opt-out. Note anything missing.
2. Does it pose as your bank, the SBA, or a funder you already use? Click nothing, not even unsubscribe. Skip to step 6.
3. Otherwise, use the opt-out method the email names, and only that method. If it says reply, send this: "Unsubscribe. Remove this address from all commercial email from you and anyone sending on your behalf. Do not sell or transfer my address."
4. If the unsubscribe page wants your phone number, business name, revenue, or a fee, close the tab. None of that can be required under 16 CFR 316.5, and a form that collects your phone number is how an email lead becomes a call lead.
5. Log it. Add an "email" row to the Part 3 log (https://mcafax.com/notebook/toolkit/call-log-template): sender, from domain, subject line, opt-out method, date used, and day 10.
6. Phishing, or still arriving after day 10? Mark it as spam, block the domain, and report it at https://reportfraud.ftc.gov. The FTC also asks you to send phishing emails to reportphishing@apwg.org (https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams). Count business days, not calendar days. Opt out on Monday, Oct 19, 2026, and day 10 is Monday, Nov 2. A pitch from that sender on Tuesday, Nov 3 goes in the log.

Email and phone are separate stops

An unsubscribe covers that sender's commercial email, not the calls. If the same shop phones you, send the written stop (https://mcafax.com/notebook/toolkit/cease-and-desist-letter) and report calls at https://www.donotcall.gov/report.html. For calls and texts, FCC 26-67 (released Oct 1, 2026) lets callers designate an exclusive opt-out method. It takes effect 30 days after Federal Register publication, which had not happened as of our Oct 18, 2026 check: https://docs.fcc.gov/public/attachments/FCC-26-67A1.pdf. Same habit on every channel: use the opt-out the message names, and log the date.

Your checklist

1. Footer check: name, postal address, opt-out.
2. Looks like your bank or the SBA? Don't click. Report it.
3. Use the named opt-out. Give your email address and nothing else.
4. Log the date and day 10.
5. Past day 10? Spam, block, report. None of this promises an outcome, and a licensed attorney can tell you how these rules apply to your own inbox. More rights: https://mcafax.com/notebook/series/know-your-rights and https://mcafax.com/notebook/stop-mca-broker-calls Coming in Part 17: your front desk picks up before the screener does. A 10-second script for staff.