Five Questions Before a Client's Event Attendee List Goes Into Outbound

Conference season produces a predictable message from clients: "We have the attendee list from the show. Can you load it into the campaign this week?"

Sometimes that list is gold. Sometimes it is a spreadsheet the client bought from a stranger who emailed them the week before the event. The two look identical in a CSV, and they lead to very different outcomes for the client's domain.

Before any event list goes into a client's outbound, we would ask these five questions.

1. Where did the list actually come from?

There are three common answers, and they are not equal:

• The client's own booth scans or meeting sign-ups. These are people who met the client and handed over their details. This is the strongest list an event can produce.
• An official exhibitor or attendee directory from the organizer. Some events provide one to exhibitors under specific terms. TFWA, for example, says its attendee list is available in the official exhibition directory on its member platform.
• A third party who offered "the attendee list" by email. Treat this as a scam until proven otherwise.

The third case is common enough that organizers publish warnings. AOC Europe's attendee list scam page says that "nearly all third parties offering to sell attendee lists are engaging in a scam." TFWA lists dozens of sender domains that have offered lists of its delegates and says those lists are "inaccurate and compiled or acquired fraudulently."

If the client cannot say where the list came from, it does not go into a sequence.

2. Was the list scraped and guessed?

AOC Europe describes how the scam lists are built: scrapers pull names from social platforms, exhibitor lists, and floor plans, then guess email formats and send test messages to see which addresses are valid. That is a recipe for bounces and complaints, all charged to the client's sending domain.

It also flags a detail worth passing on to clients. The example scam email on AOC Europe's page ends by asking recipients to reply "leave out" to stop future emails. Replying confirms the address is live. If a client is getting these offers, the right move is to ignore them, not to answer.

3. What did the event's terms allow?

Even an official directory usually comes with conditions. Before using it, check:

• Whether exhibitors may use the directory for direct outreach at all.
• Whether outreach is limited to before or during the event.
• Whether attendees opted in to being contacted by exhibitors.

If the terms are unclear, ask the organizer. The client's relationship with the event is worth more than one campaign.

4. Does it clear the same gates as any other list?

An event list is not exempt from the rules that apply to every cold list:

• Verify every address before it enters a sequence, and decide what happens to catch-all results. We covered that in a per-client policy for catch-all addresses.
• Check the client's suppression list and CRM for existing customers, open deals, and past opt-outs.
• Separate geography. International events bring international attendees. EU, UK, and Canadian contacts need their own decision, as we described in holding EU and UK prospects out of a client's first US campaign.
• Meet CAN-SPAM's basics on every message: accurate headers, a non-deceptive subject line, a physical address, and a working opt-out that is honored within 10 business days, as the FTC's compliance guide requires.

5. Is the message honest about the connection?

"Great meeting you at the show" is only true if someone met them. For booth scans, referencing the conversation is natural. For directory contacts, the honest framing is that you saw they attended, not that you met. Write the first line to match the source, and keep the source on the record so the next person who touches the contact knows which applies.

The short version

Booth scans: use them, quickly, with a message that references the real conversation. Official directory: check the terms, then treat it as a cold list. Purchased "attendee list" from an unsolicited email: do not load it. Hand the client the organizer's warning page instead.

Where GTM fits

GTM keeps provenance on every field, so each contact carries where it came from, and every send passes a compliance gate that requires a verdict and an unsubscribe URL. An event list goes through the same gate as everything else.

If you run outbound for several clients and want list sources you can trace, join the waitlist.

Sources

• AOC Europe, "Attendee List Scams": https://2026.aoceurope.org/attendee-list-scams/
• TFWA, "Beware of fraudulent list services!": https://www.tfwa.com/tfwa-world-exhibition-conference/news/beware-of-fraudulent-list-services-100014645
• FTC, "CAN-SPAM Act: A Compliance Guide for Business": https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business