How Did Murphy's Get Our Email Data?

Before we get into this, on Monday, the 21st, we contacted Murphy's founder for comment on this story. Murphy's did not respond. We also emailed The Magic Cafe's owner on Monday, and their response is included below.

A while ago, we received an unexpected marketing email from Murphy's, the magic industry's wholesaler. If you've ever bought a magic trick from a shop, good or bad, the trick was likely distributed by Murphy's Magic.

You may have heard about their in-house production studio, which produces original magic tricks with creators like Craig Petty (and me, too, ten years ago).

As great as their production team is, Murphy's core business is wholesale. Founded in 1998 by Mark Murphy, it has served as the backbone of the magic industry and stocks roughly 13,000 different items.

One Ahead has written about Murphy's a lot. They were featured in stories about faulty products, magic shops closing down, and accusations of theft (in which they never answered our eight questions). Due to its size and industry dominance, Murphy's is often in difficult-to-navigate situations. You could say that Murphy's has a monopolistic hold on our industry.

Only a month ago, we shared an opinion piece about how Murphy's could wipe out physical magic shops by switching to selling directly to magicians. And the temptation for them to do so must be growing, given the state of the world, the internet, fulfilment, and magic in general.

And sure, Murphy's already sells to consumers via channels like Amazon and Touch Of Modern – but these are not magic shops, so they can be seen as "indirect" rather than direct competition to its existing magic shop clients.

So what's stopping them from setting up a Murphy's Magic shop? Well, if Murphy's decided to sell directly to customers via their own magic shop, it might destroy their existing business.

Magic shops would likely not be able to compete and could close. The remaining stores will be the producers like Ellusionist, Alakazam, Penguin, and Vanishing Inc., who create and sell original products. These producers like these might stop selling to Murphy's (Ellusionist already did so quite publicly this year).

Suddenly, Murphy's would be operating a totally different business model, and they'd need to compete with the few remaining big magic brands that used to be their clients. More importantly, with the regular magic shops being impacted, it'll be hard for Murphy's to go back to simply being a distributor.

On Friday, July 28th, many magicians received a marketing email from Murphy's Magic for the first time. It was a surprise to many because, as far as we could remember, we'd never consented to receive Murphy's emails – email marketing to consumers also isn't something wholesalers, who sell to businesses, tend to do.

Personally, I couldn't remember giving them my email. I'm not really one to join mailing lists (ironic, considering I write one for a living). Maybe they collected my email when I was briefly a vendor with them six years ago, but they shouldn't add my email to a marketing list without consent.

I searched my inbox for a welcome email I might have missed and found none – July 28th was the first time Murphy's marketing team had ever emailed me.

And then more magicians mentioned the new marketing emails to me. We've spoken to many more when writing this story, and we haven't spoken to a single person receiving the marketing emails who says they recall opting in.

Murphy's doesn't have a storefront. So there's no obvious way magicians would have input their email addresses on Murphy's website. We were wracking our brains in case there was some giveaway we entered that we'd all forgotten about.

One magician we spoke to assumed the marketing emails were spam. They highlighted that the emails featured a completely different Murphy's logo to the one on its website. They pointed out that the emails pushed people to one specific magic shop they'd never heard about before and didn't feature a physical address.

It's unusual for any wholesaler to promote only one of its clients – but it did in this first email and sent magicians to the same one store in 60%+ of their emails. It feels odd to pick a favourite when they have hundreds of dealer clients. And why choose a shell of a store that one person runs, has no presence within the community, and has entirely abandoned social media? (It turns out a previous Murphy's employee owns that one store, but that's a story for another time)

So that's how one of the magicians we spoke to explained it – the marketing email had a logo they didn't recognise, and it sent him to a shop he'd never heard about that looked like one of those spam pirate sites, and they weren't even sure how Murphy's got their email address in the first place! – So they marked it as spam.

But then – a new reader submitted this same story to us.

Their email began familiarly:

Their marketing emails started at the same time as many, but we've spoken to magicians who started getting them before and after July 28th. Regardless of when Murphy's collected our emails, it appears they're adding us in weekly batches – something marketers can do to avoid sending spam signals to email providers (though this is also just good practice for anyone wanting to email a huge list for the first time ever).

But then everything changed.

This new magician added something unbelievable to their story submission. Unlike the rest of us, who had no idea how Murphy's got our email data – this one magician believed they had an answer. Not only that, they had screenshots.

A lot of privacy-conscious magicians like to filter their incoming emails. We see it all the time with One Ahead members. They'll sign up for our magic newsletter and include "oneahead" somewhere within their email address.

If they have a custom domain, they might use email forwarding and sign up with an account like [email protected]. They might use "+" features with specific email platforms and sign up with an email address like [email protected].

You can use these kinds of email tools to help sort through your emails, but they're also a good way to keep track of your private data. For example, if you start receiving spam emails to your email address, you might be able to tell where the spammer got your email from or who sold/leaked your data.

The new reader who submitted the story was privacy-conscious. Whenever they create an account with any service, they use these features – this meant they knew not only that they never gave Murphy's Magic their email address but also where the email data originated.

The email they used looked like this:

[email protected]

Oh, shit.

The Magic Cafe is the longest-running, biggest and most chaotic green magic forum on the internet. The forum featured heavily in our story about the EDCeipt drama, in which Michael Weber was accused of using a sock puppet account to promote his work. If we know anything about The Cafe, it's safe to assume its members will have strong opinions about this new email story.

What does this mean? Unfortunately, we can't know how Murphy's emails were sent to an email address the reader says they only used for The Magic Cafe – we also don't know how they got the rest of our email data.

So, we emailed Murphy's for comment and detailed this account and the screenshot of their marketing going to the user's Magic Cafe email address.

We requested a comment for the story.

Murphy's never responded.

Oddly enough, we did stop receiving their marketing emails, though others continue to receive them. We emailed the owner of The Magic Cafe next.

It's unlikely Murphy's purchased the email list from the Cafe – and if they did, they'd be breaking the law by emailing magicians based in certain countries.

For example, GDPR is a European law stating that email subscribers must opt-in to receive emails with active consent. The UK has a similar law in place. Even if you're not based in Europe, if you have customers or subscribers in Europe, you must comply with GDPR. Buying an email list is a clear violation of GDPR.

Some states, like California, have strict rules even in the USA. The newer California Consumer Privacy Act (CCPA) states businesses need to honour requests from California residents to "access, delete, and opt-out of sharing or selling their information." By purchasing an email list, you can't be sure that a vendor has followed those rules.

Regardless, we don't know if Murphy's purchased the email data.

So, we sent The Cafe's owner the following:

The Cafe's owner was quick to reply:

The phrase "Really not hard to figure out" hit us pretty hard, considering this story is something we've now spent weeks trying to figure out.

We replied and asked The Magic Cafe asking for more details:

The Cafe's owner never replied again.

It took a lot of trying, but we eventually found one active account created in 2004 with a public email address on their profile. It turns out that currently, Cafe users can toggle on or off an option in their settings to publicly display their email. This isn't a feature we were previously aware of, and we're not sure if there was ever a time when emails were listed publicly by default.

This still leaves a lot of unanswered questions.

The magician whom Murphy's is emailing their Magic Cafe email does not have their email address publicly listed on the Cafe.

Even if they did, if Murphy takes a public email from a website and adds it to a mailing list without consent, that would be wrong – and illegal in many countries, including all EU members and UK residents (it's based on where the receiver lives, not the sender). The rules are pretty similar to buying email lists; you can't add people to a mailing list without their explicit consent.

Would Murphy's take magicians' data without their consent and add them to their mailing list? Well, they're already breaking one of the most basic email marketing rules; their marketing emails do not include a physical address, which is a federal CAN-SPAM Act requirement. And the fines are pretty big:

Each separate email.

That's at most $300,000 in fines with the six emails we've seen.

Perhaps we'll all be able to tell if Murphy's read this post if they suddenly add their address to their marketing emails. And if they do that, it'll undoubtedly be even more odd if they never comment publicly on how they got our data.

Did you start receiving marketing from Murphy's? Do you remember opting in to receive them? The mystery continues.