Ask HN: People who use different emails everywhere, who sold you to spammers?

…except for single email with a google docs link that got sent to cs@mydomain. I don’t know what I used cs@ for. I don’t have any other emails to that address. Very odd.

I very rarely receive spam on the email address I used to post on the Debian bugtracker, and on the generic address I give to individuals. Apart from that, none of the specific email addresses are spammed.

It's been almost 6 years now. I sometimes understand why I receive some infrequent broadcast mail thanks to the specific address I used to subscribe.

They were breached.

This is a phishing attack.

After a while I talked with one of those customers and they knew about it. It was "an email that got compromised".

Eg. one of their employees did fall for the phish and opened the email, clicked the link, opened the binary. Got infected and (a part of?) their inbox uploaded to the spammer. That is then used to send out new targeted phishing attacks where the name is spoofed, but send from another victim of theirs. Pretty effective phishing attack it seems. Took me a bit before I realized what I was looking at as the email seemed to come from that customer. It was only because it was a bit weird that I noticed things being off like that the email address itself was different.

Also not to say this is how all recruiters work. I've spent enough time in the industry to know in 2 minutes or less if I'm talking to a decent recruiter.

Can you describe what it is you need to keep track of ?

I imagine giving out servicename@domain.com and if you get spam on that pseudonym you just block it in procmail or smtpd.conf or (whatever you do in gmail).

Right ?

     E1iusbp-00017V-NM@steve.org.uk

Now I get phone bills, internet bills, promo emails, subscription emails, two factor emails, and sometimes even bank related emails addressed to someone who shares their first name with me.

It's been years now. I've reported the emails, but neither the intended recipients, not the sending organizations seem to care.

I agree, my namesakes are idiots too and so are the companies who don't have a simple email verification system. :(

* A Joe who runs a lego engineering team at his high school

* A Joe who goes to bible study in Utah

* A Joe who is building a house in Victoria Australia (I'm so familiar with him/others screwing up his email that I can forward it to him and his wife easily.

Now, I get Bank Statements, Credit Card, Health, Insurance and whatnot for over 5+ "Brajeshwar"s in India. I just ignore them as I use my GMAIL ID just for newsletter subscriptions and ramnants of the old Internet but I do check once a week during my weekly digital chores.

I used to reply to misaddressed mail when it amused me. I used to string along a whole family of people that included me in group emails with racist Obama memes and pictures bragging of poaching.

I stopped replying to these when in another case I was asked to tell estranged and family member that their sister had cancer since I was the only one still in contact with her. I did inform them they had the wrong address at that point.

I’m still on a mailing list for senior members of a local police department and even was sent logon/passwords to some of their systems but I’ve learned not to try to correct these things, it’s just too much of a hassle. In the case of Venmo and Verizon I couldn’t get it fixed even with phone calls.

Imagine dealing with Comcast customer support. Then imagine not even being a customer anymore trying to get this resolved. Now imagine explaining how you're not the person on the account yet have the same name and how this is a huge privacy/security violation.

Took years to get rid of. One day I'm waiting for a silly collections bill or something to show up in "my" name for the other person.

I really wish I could get his phone bill sent to my email address so I could call and tell him he could have gotten a larger raise

+1. My OG name email has been mistakenly registered for a PayPal account, but there's no way I can go about disavowing the account, or removing my email address from it.

I don’t even use gmail anymore, but I keep looking into what kind of fun emails I get (and I report every opt-out-only newsletter, which includes Google Fiber and some US Democratic Party thing, as spam).

But in the last few years I started getting hotel reservations, golf course membership, bills, orders for liver supplements. I tracked down who it is ages ago and sent them an email (I was cordial - "Hey we have such similar names but I'm on the other side of the world, crazy huh?") and got no response. Eventually I replied to the liver pill people and said "Hey this isn't me and if you could let the actual person know that'd be great" and the emails stopped. Way to go liver pill people.

A few years ago I tried to contact some of my other selfs to ask them to mind their email, but never got any response. I'm just ignoring them now or hitting the spam button (after all, the senders should have a process to check the address instead of taking erroneous email addresses written by hand on paper).

Add Discord to the list.

Use an account with an unverified mail? Fine by us!

Go and try to actually verify the mail? Alarm bells go off and the acct locks up (sorry, not sorry for the owner of that acct)

This email is regarding: [].

Class: MATH 7 ADVANCED Prd: 2 Teacher: []

-----------------------------------------------

Good evening, please check [] for missing work, complete it and submit it. Let me know if you have questions or need any help or anything opened up or more tries. Remember the Ch. 3 test due today. Thank you, Mrs. []

I replied:

I think you've got the wrong email address.

Thanks, David

The teacher then replied:

My apologies. You are correct. Your son is crushing it :) and I failed to take him off the group email. Thank you so much for letting me know and keep up the great work! Again, I apologize for the inconvenience. Mrs. []

I then replied:

Thanks! Only one thing: I don't have a son.

The problem is the word spam. What you describe, misdirected mail from completely legal businesses is not really spam, even if it is junk for you personally.

There is aggressive marketing of very vaguely related products you have actually registered for. There is marketing of illegal products mostly using harvested addresses. There is phishing often using stolen addresses.

If you want to understand the problem as the OP obviously does just speaking of spam is not helpful.

Over a year ago, I noticed that somebody's paypal was set to my gmail account. They had also used my account for payments to Donald Trump (I was getting hilariously desperate and pleading messages for more donations) Banggood, and Amigo Loans (as guarantor)

I was able to get information about different addresses they have lived (Ireland - not sure how many Trump supporters live in Ireland, which was weird), what other email addresses they had, etc.

In the end, I logged into their paypal (surprisingly easy) and changed their email address to the correct email address, and emailed them their new password.

I still get the odd one-off email from other places, such as a damp report for a property in Hemel Hempstead, but at least I haven't had any more paypal messages. I sometimes wonder about the legality of what I did - obviously I did nothing malicious, but I suspect it contravenes the letter of at least one law. But the thought of being made in some way responsible for the security of someone else's finances filled me with dread.

I haven't noticed many leaks/sales at all of my specific account addresses. I get almost all my spam on my regular gmail, and promotions for companies that my namesakes have signed up for, left my email at a store, etc.

I have identified several people from the variety of emails I get, including work/school/personal.

> But some of the companies responsible of the subscriptions, like Paypal, are assholes. They allow the creation of accounts without verifying the email, then refuse to admit it's their problem and do something about it.

This is my absolute biggest gripe. Someone signed up for AT&T using my email. I contacted their support on facebook, and even after explaining the whole issue they asked my for my phone number, and recommended I call their support. I'm not even in the country. They stopped responding when I pointed that out.

While I want to trash AT&T (deservedly), they're unfortunately not alone in that behavior.

The bills are in encrypted pdf-- but the encryption is trivial to remove. I looked at the bills, its someone with a name similar to mine, just one letter different. I emailed the real person, telling him he had used my email, but got no reply.

I just press spam now, and the emails have stopped coming to my inbox. But I still get the emails 6-7 years later. Its mind boggling as how a) Airtel never confirmed the email b) Havent stopped sending even though they've been going to spam for years now

(The last one of the above I replied to - it was an order for a rifle scope. I sent what I thought was an obvious joke email back asking whether it'd help me hit my neighbours' puppy at a mile range. The gun shop replied back suggesting an alternative scope... Moral: never apply UK style humour to US situations, especially not about guns...)

* obviously this is not my email address, but it demonstrates how the situation arose.

I do not have a facebook account

I mostly get signed up for newsletters but I do actually have the name and address of one of the people who uses my email address. I know its not exactly polite and didn't want to be mean and cancel any orders but I mayyy have logged in and changed her name on the delivery address to "stop using my email address please" and she's never done it again.

theres also a teenager at a school in the US using my email address on social media I get a lot of requests to send me freebies!

I also apparently have an espn account now, if I liked sports I'd be taking advantage of that one!

Even weirder was one time I had RSVP's to a wedding. The couples name was exactly the same as my partners and I's! I had to email the pastor and say I think you have the wrong email address!

I've had blood test results, graduation photos, I get emails from this girls doctors. I've contacted them so many times to say I'm not your patient but they don't listen. I also know what car she leases! At this point she must have realised!?

I have tried finding the numerous people throughout the world with the same name and surname as me and notifying them and asking them kindly to update their contacts or to stop using mine (name.surname@gmail scenario), some work, some don't.

At some point I even started canceling their appointments/subscriptions/closing their accounts, hoping they'd stop but apparently no use. Not a month passes without a few of these emails popping up in my inbox. The most annoying are when I am stuck in a group email with multiple recipients that are replying all.

He also is down for _any_ sweepstakes and has dubious dating preferences. He’s out there wondering why he never wins anything and no one swipes on his profile.

[0] dots are not significant so it's basically the same email address and it is mine, but they use it without the dots while I use it with.

This is my biggest issue with what you're talking about. I get annoyed at the clueless users who happen to share my initials and last name but I can forgive them for their ignorance.

But, IMHO, any company, in 2022, that uses email for authentication, or for any type of business/financial exchange of information, that doesn't bother to do a simple validation of "do you really own this email?" should not be allowed to continue to operate!

I sadly learned long ago that expressing this opinion to their support or security contacts is useless.

Recently, google/gmail decided to be too helpful. The namesake used my email address when they booked a stay at a hotel (helpfully the hotel made it impossible for me to unsubscribe!) The hotel has sent me a few emails related to the booking, reminders and the like. Google being Google, sees the email, and creates a calendar entry for me. I delete it. The next email comes in, and boom, there's the calendar entry again.

Someone even has a Paypal account on my dot-less email. It beats me how a payments company can let somebody add an email without verification and not offer an easy to way to remove it.

I had first.last@gmail.com and indeed got a lot of email that isn't mine. A few years back I switched to token1.token2@gmail.com, where token1 = something vaguely similar but not my first name, and token2 = nonsense word. Basically an address that is something between random string and insider joke.

Of course I always include my correct real name in the From: field, fill it correctly in all the relevant fields on forms and have never suggested to anyone that my actual name is "Token1 Token2". Nevertheless it's not uncommon for people to assume that this is my name, and I get people writing to me "Hi Token1," or "Dear Ms. Token2". I even had an expensive electronic item shipped to my correct home address but addressed to Token1 Token2, and returned to sender, since such a person doesn't live here (and likely doesn't exists at all).

Some people just don't understand how email addresses work.

- One guy in London. I get monthly invoices from his daughters childcare centre and the odd email from his solicitor about his investment property. His wife replies to all of these CCing me in too.

- A Native American artist who gets a few emails to purchase his work. I don’t mind this one so much, I found his real email and forward everything on to him.

- Then there’s this other complete douche in the States. Emails about his car servicing reminders, all sorts of totally boring crap. One time I even got a flight booking for him. I though someone had stolen my credit card info and booked a flight in my name at first. I could click into it and change anything. I could have canceled it. I should have picked terrible seats or preordered the worst thing on the menu for him.

Basically the majority of apps in the Play Store have permissions to see the contacts, then they vacuum up the whole address book and sell it to companies doing correlation with data from other services—and pretty much compiling giant stores of identifying info and contacts. I guess it's a given that tons of that info also falls into spammers' hands, and since almost no one in the public ever heard of these particular companies, they face zero consequences for what they're doing.