Tag: email scams

This morning at around 11am, I noticed an unusually high number of emails in my Gmail spam folder. I had a quick look and saw there was a lot of ‘Mail delivery failed: returning message to sender’ emails – not unusual, but in this case there were literally hundreds of them. As I was watching, the number increased. A bit over five hours later, I have over 21,000 bounces – so around 3,600 bounces per hour.

Turns out someone got a hold of my Gmail email address, and decided to make it (and my name) the ‘from’ field for a new spam campaign for their latest scam – http://tinyurl.com/moneyonline2010 (deliberately not linked). The email is as follows:

Good Morning,
Thought id share a link that helped me and my bank balance out!
Finally an easy way to make $1000 every day , without further hype check out the link below
http://tinyurl.com/moneyonline2010
To your success online
David

If you have received that email, please note that I am not sending it to you – someone is forging the ‘From’ header so it simply looks like it is coming from me.

Believe it or not, this is how the email system works – anyone can send an email claiming to be from anyone else, from any email address. Most email clients should let you do this – you can send as anyone, but obviously if someone hits ‘reply’ and sends something back, it will go to the person you’re pretending to be (if you used their actually email address, anyway).

Almost all of the bounces appear to be from a mail server that is rate limiting the send, as they all have the text: “Domain bristolz.co.uk has exceeded the max emails per hour (500) allowed. Message discarded.” So that’s at least some good news, in that it means ‘only’ 500 spams are making it out into the world with my name on it.

My first thought was that maybe my Gmail had been hacked and someone was actually sending these emails through my account, so I had a quick scan through to confirm this was not the case. I thought it was unlikely anyway as I assume Gmail have filters and limits in place to prevent people sending that many emails per hour.

– none of these messages were present in my sent mail, or IMAP sent mail
– ‘Last account activity’ indicated no-one other than me had logged into my account

I have contacted abuse@sky.com, which appears to be the ISP that owns the originating IP address (I will be amazed if I hear back), and I’ve also contacted tinyurl.com (as their terms specifically prohibit using their service for spam). In the meantime, sorry – but it ain’t me and it ain’t my fault!

I recently got an email from PayPal (an actual one, not a phishing attempt) telling me that they’re changing their email address (subject: “Important Address Change Information from PayPal”).

I noticed this part:

How do I know if an email is really from PayPal?
PayPal emails only come from a ‘paypal.com.au’ or ‘paypal.com’ address. We will always address you by your first name AND last name.

It’s important to note that the first part of this answer is utterly useless from a security point of view. Anyone that knows anything about the Internet will tell you that it is completely trivial to send an email so it looks like it is coming from any email address. Email has no built-in security to stop this from happening.

It’s a little annoying that PayPal focus on that by putting it first, because it’s much, much less of a useful security measure than the second thing they propose – using your first AND your last name. Most email spam/phishing attempts simply attempt to guess your name by deriving it from your email address – for example, if your email address is david@example.com, then they’ll start their email with “Dear David”.

However, there’s (almost) no way to derive your last name in bulk mailing attempts like this – unless you already have that information, like PayPal would if you had an account with them. (I say ‘almost’ because there are fringe cases where spammers could guess your first and last name – for example, if your email address is formatted like david.harrison@example.com).

If you’re reading emails and wondering whether or not they’re from who they purport to be, bear in mind that looking at the actual email address is never a good way to do it. You’ll need to look for other clues.

Unless, of course, they’re using PGP or some other mechanism to digitally sign their emails. It boggles my mind that financial institutions aren’t offering this as a matter of course, even if only a handful of people would actually use it.