Scam emails from Amazon

[Bouleversee]

Having endured endless scam phone calls purportedly from Amazon, I have now started receiving emails from them which are clearly attempted scams. I'd love to know how these crooks get my email address and when it will ever stop. I get lots from PayPal which I delete because I have had no dealings with them for many years. I've got to the stage when I suspect even genuine ones from my banks etc. as few write to me these days. Even Iweb sends its changes to terms and conditions by email which can easily get by-passed if in a hurry or accidentally deleted. What is the world coming to?

[didds]

purely guessing ...

if your email address is a common generic one eg @gmail.com, @yahoo.com

spammers hjust send emsails to <string of characters>@gmail.com etc.

Eveentually <stroing of characters> in such \ brute force attack just matches <real address>@gmail.com etc.

If you own your own domain once that domain is findable on the web (eg doing brute force attacks on whois lookups for <string of characaters>.<TLD>
[ TLD = top level domain eg .com, .co.uk etc) ] then its rinse and repeat with the <sting of charcaters>@<discovered domain>.

And allegedly reputable companies sell email lists (that box about provide your contact info to partners etc ? ). And reputable companies have less reputable employeees that somehow get hold of email lists etc...


didds

[stevensfo]

Having endured endless scam phone calls purportedly from Amazon, I have now started receiving emails from them which are clearly attempted scams. I'd love to know how these crooks get my email address and when it will ever stop. I get lots from PayPal which I delete because I have had no dealings with them for many years. I've got to the stage when I suspect even genuine ones from my banks etc. as few write to me these days. Even Iweb sends its changes to terms and conditions by email which can easily get by-passed if in a hurry or accidentally deleted. What is the world coming to?

I share your frustration. The scam emails are getting cleverer every year and I'm constantly warning my elderly mother, who has just about mastered her laptop, to treat every email as suspicious. It's getting ridiculous and I do hope that the police will start taking it more seriously, but we've been saying this for years. My sister is getting our mum a smartphone for her birthday, but only to use Whatsapp for video chats, and will make it clear that no apps are to be downloaded.

Oh for the good old days when a Nigerian email would promise me ten million dollars in dollars. What nostalgia.

Steve

[XFool]

...I remain Sir,

Yours, unspammed and mystified!

[Bouleversee]

purely guessing ...

if your email address is a common generic one eg @gmail.com, @yahoo.com

spammers hjust send emsails to <string of characters>@gmail.com etc.

Eveentually <stroing of characters> in such \ brute force attack just matches <real address>@gmail.com etc.

If you own your own domain once that domain is findable on the web (eg doing brute force attacks on whois lookups for <string of characaters>.<TLD>
[ TLD = top level domain eg .com, .co.uk etc) ] then its rinse and repeat with the <sting of charcaters>@<discovered domain>.

And allegedly reputable companies sell email lists (that box about provide your contact info to partners etc ? ). And reputable companies have less reputable employeees that somehow get hold of email lists etc...


didds

I suspect the latter because my email address contains numbers as well as my names and I don't see how it could be arrived at randomly. I don't have a domain address.

[Adamski]

Way of the world now unfortunately. Feel sorry for the elderly who can get more easily scammed as not as IT savvy.

[Midsmartin]

You can enter your email address on this website to see if any of your details have ever been leaked in a list obtained from some hacking event.

https://haveibeenpwned.com

If so, then that's where they got your address from.

The major email providers (eg Gmail, Microsoft) are reasonably good at detecting scam emails, though not of course perfect. Consider chagin g your email provider if your existing one has little or no spam checking.

[Bouleversee]

You can enter your email address on this website to see if any of your details have ever been leaked in a list obtained from some hacking event.

https://haveibeenpwned.com

If so, then that's where they got your address from.

The major email providers (eg Gmail, Microsoft) are reasonably good at detecting scam emails, though not of course perfect. Consider chagin g your email provider if your existing one has little or no spam checking.

How do you know that site is safe?

Yahoo lets scams through but puts things that are not scams, e.g. ADVFN's Morning and Evening Market Bulletins into spam even when I have been receiving them for years.

[Watis]

Yahoo lets scams through but puts things that are not scams, e.g. ADVFN's Morning and Evening Market Bulletins into spam even when I have been receiving them for years.

You should be able to mark your ADVFN emails as genuine by opening one, then selecting 'not spam' to tell Yahoo that you want to see these in your inbox in future.

And/or, add the sender's email address to your contacts directory.

HTH,

Watis

[Bouleversee]

Yahoo lets scams through but puts things that are not scams, e.g. ADVFN's Morning and Evening Market Bulletins into spam even when I have been receiving them for years.

You should be able to mark your ADVFN emails as genuine by opening one, then selecting 'not spam' to tell Yahoo that you want to see these in your inbox in future.

And/or, add the sender's email address to your contacts directory.

HTH,

Watis

Yes, I did that once I realised they had gone into spam but it never occurred to me to look there at first so I missed them for quite a while. Why on earth should they think they and alerts from Oxford Instruments ard spam or scam and then leave obvious scsm attempts like the fake Amazon one?

[XFool]

You can enter your email address on this website to see if any of your details have ever been leaked in a list obtained from some hacking event.

https://haveibeenpwned.com

How do you know that site is safe?

I've always wondered about that and have never checked my own address.

Perhaps that's why I'm not spammed?

[didds]

I suspect the latter because my email address contains numbers as well as my names and I don't see how it could be arrived at randomly. I don't have a domain address.

randomly : the character string will just be a mix of letters, numbers, special characters (that top row shift set etc). Just having numbers doesnt mean a random string cant be sledge hammer found.

domain: everybody's email address has a domain name - thats how it works - whether that be boulerversee.com, or gmail.com etc. Its the bit after the "@" in an email address.

didds

[Midsmartin]

How do you know that site is safe?

It is apparently run by an individual well known in the it security business, and has been there for many years with no problems. But I can't absolutely prove it's safe.

[Bouleversee]

I suspect the latter because my email address contains numbers as well as my names and I don't see how it could be arrived at randomly. I don't have a domain address.

randomly : the character string will just be a mix of letters, numbers, special characters (that top row shift set etc). Just having numbers doesnt mean a random string cant be sledge hammer found.

domain: everybody's email address has a domain name - thats how it works - whether that be boulerversee.com, or gmail.com etc. Its the bit after the "@" in an email address.

didds

I see. My domain is yahoo then but I find it difficult to believe that my email address was randomly selected. I feel sure it was nicked one way or another.

Another irritating example of yahoo's incompetence: After the incorrect spamming of the ADVFN bulletings, it occurred to me to check whether an awaited email from a new contact might have gone into spam. Couldn't find that but I found that the reply from someone (a regular email contact) I had emailed shortly before in response to an earlier one from him today had gone into the spam box. Absolutely nothing in any of them to suggest spam and the contact's email address actually stated his position as Estate Manager of the estate I live on. I wonder how many other messages I have missed over the years as I was not in the habit of checking what was in my spam box.

[Breelander]

... I wonder how many other messages I have missed over the years as I was not in the habit of checking what was in my spam box.

I long ago got into the habit of checking my Spam box occasionally. When you read an email in the spam box there is a 'Not spam' option at the top on the toolbar that starts with the 'reply' icon. Click that and it gets returned to the inbox, and (as I understand it) also trains the spam filter not to mark similar emails as spam in the future.

[Bouleversee]

Yes, I had done that, thanks and will check every night (or earlier if an expected message doesn't arrive) to see whether there is anything that should be in my inbox. Strikes me that the filter hasn't been very well trained if it suddenly decides that messages which are sent and read regularly are spam.

[Midsmartin]

It may be obvious to you, sometimes, whether an email is scam or real, but it's not necessarily easy to write software to detect it. Scammers are in a constant creative battle to make their messages look genuine, using all sorts of methods to get around checks.

I recently read of a new method used by scammers, namely to email a QR code image in the hope that you follow it to their malicious webpage. Cunning, because there is no html link to a webpage that can be analysed for malicious intent, and even the image has no text that could be maybe interpreted.

It also brings into use a fantastic new English word: quishing

Looking through my Gmail spam folder, it's remarkable how free mistakes it makes.

[Lanark]

I see. My domain is yahoo then but I find it difficult to believe that my email address was randomly selected. I feel sure it was nicked one way or another.

They don't randomly select addresses, they just blanket email every possible name which might exist at yahoo.com

john.smith@yahoo.com
john.smith2@yahoo.com
john.smith1234@yahoo.com
john_smith1718797@yahoo.com
john-smith97987@yahoo.com
etc, but with millions of combinations, most of them will be invalid names but enough reach a target to make it worthwhile.

gmail has 1.8 billion accounts so just about anything you choose has been signed up by someone.

If you choose a really obscure email like jo8.76-au8-d6.5d5d3n2@yahoo.com
you will get much less spam, but thats not very easy to remember.

Similarly if you use an obscure domain the spammers are not aware of, you will get far less spam.

[dave559]

I see. My domain is yahoo then but I find it difficult to believe that my email address was randomly selected. I feel sure it was nicked one way or another.

Another irritating example of yahoo's incompetence: After the incorrect spamming of the ADVFN bulletings, it occurred to me to check whether an awaited email from a new contact might have gone into spam.

Yahoo is no longer the internet pioneer that it was in the 1990s. It has sadly been in decline since the late 2000s, as they got distracted by the money rolling in (while it lasted). They neglected to keep up with newly emerging rivals and didn't invest in their systems to keep their early mover advantage nor keep up with security best practices. The result: they have suffered at least one major hack (of all accounts) and it is now a shadow of its former self, the remains of the already decaying company having been (for some strange reason) passed around by several different buyers.

In all honesty, you would be best placed switching to an email hosting company that does invest in the maintenance and security of its services. Some people register a domain name and then find a good, but affordable, hosting service to host it (typical cost, a few tens of pounds a year), which means that you can easily switch to a new hosting company in future if need be, but without having to tell contacts yet another new email address once it is set up.