Correct, but you get to see who leaked you.

Depends if the criminals are smart enough to strip the +.. part when sending you phishing.