5 ms·

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. On

by Pxtl 9y ago

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid email address. The very first interaction when a user registers an account with their email on the service needs to be "Welcome username to MyCompany.com! If you didn't create an account with MyCompany, click here to let us know and we'll remove the email address from this user's account!" If Netflix does not do this, Netflix is doing it wrong. It also would solve your security issue - by immediately notifying the address that a new account has been created on them, it notifies the user to expect additional emails and allows them to take action immediately. This also prevents another problem: What happens if somebody has already accidentally claimed my email address on a service I want to join? If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address.

slyall 9y ago
I have a few. On in New York used by to confirm a doctors appointment (with some information on their condition). They also gave my address to their broker who sent an account summary. Bond portfolio in the millions. Some lunch delivery server in Mumbai sends sends out emails to the address provided with no option for me to remove my address. Another one or two in the UK who put me down for random stuff. I just got one for a hotel booking. Google usefully added it to my calendar. "My" X-Box live account seems to have gone. I did enjoy repeatedly rejecting "parental" permission for some kid to join Club Penguin though.
allochthon 9y ago
I have this problem a lot as well. There was someone with my name with a Bank of America account that regularly bounced checks, and BoA provided no way to disassociate my email address from the account. These days I'll flag any email from a service as spam, no matter how well known, if there was no email verification step.
- Pxtl 9y ago
  Yup. I had some guy's credit card bills appearing. It was actually super weird - somehow Google had metadata about the credit card bill that was not in the body of the email, so I'd get "reminders" on Google Now saying "pay $1200 to Notyourbank by the 1st of Octember", but I couldn't actually see that bill without logging in (which, obviously, I could not and did not try to).
  - annerajb 9y ago
    Btw that meta data I believe it's in the body of the email. Hidden with some html tags that Google tells companies to use so they can do those things. Inspect the source of the html of the body and see if you can find it there.
dpwm 9y ago
I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address. I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying. If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to register without obtaining a new email address. I wouldn't mind but my name is really not that common -- my surname is uncommon enough for me not to have met another with that surname outside my family.
- Pxtl 9y ago
  Yeah, that. While the dots may present a marginal security risk, they provide a useful workaround for sites that fail to allow the owner of an email address to remove their address from another user's account.
- nebulous1 9y ago
  Why can't you claim the original accounts?
  - dpwm 9y ago
    The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address. I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash. I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this. There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form. A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details. You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited. In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.
quasarj 9y ago
Yep, same here. I've got a "DJ" in the US, but also a guy in India. The Indian guy is always getting legal threats for not paying his phone bill.. I feel a bit bad that he's not even getting the emails, but I have no idea how to actually contact either of these people...
- spc476 9y ago
  Reply to the sender then, saying they have the wrong email account. That's what I do and over time it cuts down on the incorrect email I get.
  - Pxtl 9y ago
    Half the time these emails come from donotreply@domain.tld
morelikeborelax 9y ago
I have the same issue, except I have a 6 character nickname using 3 unique characters at gmail and people use it for all sorts. Games, flights, utility bills, shopping sites, phone contracts, dating sites and much more. From all over the world. I had someone else's dropbox too, and even after the continued warnings they would cancel it and had cancelled it there were messages to access it still, that it was still there with the ability to view data. The strangest by far though is the huge amount of gmail accounts created with my email as the backup. I have to assume that wording on some localisations indicate you need one so they mash the keys and pop in my gmail. So I have hundreds of security alerts for recovery and notifications it has been set. Funny old world.
dnr 9y ago
Same here. I have a six character gmail address which includes a common name, and I get an average of between one and two misdirected emails a day, sometimes more. Stuff from all over the world, signup emails, invoices, love letters, confidential documents, etc. Mostly the non-dot version, but sometimes a version with one dot. It's infuriating, but I couldn't possibly change my email address at this point; it's tied to hundreds of accounts :(
bluehatbrit 9y ago
Same with me, I have someone who is in the US (I'm in the UK) who has registered for a university and attempted to buy a car using my email address. They must be fairly disorganised as I keep getting emails about overdue library fees. No matter how many times I email these places, they never remove the email from their system. I'm hoping GDPR might give me a hand with that, though I'm doubtful if they're places like a US University. Email validation is a must for all services, people make mistakes and clearly some people don't even know their own email address. This is a problem with both Google and Netflix. Netflix are being negligent and Google should retire this feature.
jjeaff 9y ago
I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in. Then they can never access the account and continue to to use the service. Where available, I will delete the account as well. I found that if I don't do this, then I am just going to be receiving notification emails forever from that account.
- BoorishBears 9y ago
  If this was me and it was happening often enough to be such a nuisance I had to hijack people’s accounts, I’d just get a different email. Mind you, I’m saying you should have to give up your email because other people have trouble spelling, just stating how I’d handle it.
  - jedberg 9y ago
    I've had my gmail address for 14 years now (to the day actually). There is no way I'd give it up because of some morons.
__david__ 9y ago
It's funny, saying "email doppelgangers" reminded me that I have the same issue with phones and physical addresses (but not email since I use a unique domain name). I get multiple snail mail bills for DirecTv to people with different names but my address. One of them apparently didn't pay, so now I'm also getting collections letters addressed to them at my address. I've also had someone in Oregon use my google voice number at some doctor's clinic, so I was getting voice mail transcriptions about appointments and certain tests that needed to be run. Turns out lots of people just can't figure out their own unique ids, whether they're email, phone, or home address.
Splines 9y ago
> If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address. This happened to me - someone registered an Uber account with my email address. So I password reset it and now I have an Uber account for no good reason.
lagadu 9y ago
One of my emails is a "one name" gmail address so I get a few of these fairly often. I've tried doing the good thing where possible and trying to get it changed by contacting the provider but I just gave up. If I get more than a couple of emails from any account, I just hijack it permanently; I've found that deleting the account will only lead to the offender recreating it.
- artofcode 9y ago
  I have the same issue, but Uber has 2FA on the account through SMS. This way I can't login to cancel the account, and there is no 'unsubscribe here' link in the emails. Also had someone use my email to sign up to an airline. After messing with the seat assignment and meal selection a few times it became old and customer service didnt know what to do, so I changed the associated email to 'helpdesk@airline.com' Even funnier was how a gameshop website that I did have an account with actually changed my password and account details to be assigned to someone in another country. No notifications etc... So now there are a bunch of trade-in credits on my account, after changing it back to my own details.
simooooo 9y ago
I have one of those too. Who has signed up to the world's most persistent architecture and industrial construction email lists.

by Pxtl 9y ago

slyall 9y ago

I have a few. On in New York used by to confirm a doctors appointment (with some information on their condition). They also gave my address to their broker who sent an account summary. Bond portfolio in the millions. Some lunch delivery server in Mumbai sends sends out emails to the address provided with no option for me to remove my address. Another one or two in the UK who put me down for random stuff. I just got one for a hotel booking. Google usefully added it to my calendar. "My" X-Box live account seems to have gone. I did enjoy repeatedly rejecting "parental" permission for some kid to join Club Penguin though.

allochthon 9y ago

I have this problem a lot as well. There was someone with my name with a Bank of America account that regularly bounced checks, and BoA provided no way to disassociate my email address from the account. These days I'll flag any email from a service as spam, no matter how well known, if there was no email verification step.

Pxtl 9y ago
Yup. I had some guy's credit card bills appearing. It was actually super weird - somehow Google had metadata about the credit card bill that was not in the body of the email, so I'd get "reminders" on Google Now saying "pay $1200 to Notyourbank by the 1st of Octember", but I couldn't actually see that bill without logging in (which, obviously, I could not and did not try to).
- annerajb 9y ago
  Btw that meta data I believe it's in the body of the email. Hidden with some html tags that Google tells companies to use so they can do those things. Inspect the source of the html of the body and see if you can find it there.

dpwm 9y ago

I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address. I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying. If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to register without obtaining a new email address. I wouldn't mind but my name is really not that common -- my surname is uncommon enough for me not to have met another with that surname outside my family.

Pxtl 9y ago
Yeah, that. While the dots may present a marginal security risk, they provide a useful workaround for sites that fail to allow the owner of an email address to remove their address from another user's account.
nebulous1 9y ago
Why can't you claim the original accounts?
- dpwm 9y ago
  The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address. I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash. I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this. There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form. A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details. You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited. In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.

quasarj 9y ago

Yep, same here. I've got a "DJ" in the US, but also a guy in India. The Indian guy is always getting legal threats for not paying his phone bill.. I feel a bit bad that he's not even getting the emails, but I have no idea how to actually contact either of these people...

spc476 9y ago
Reply to the sender then, saying they have the wrong email account. That's what I do and over time it cuts down on the incorrect email I get.
- Pxtl 9y ago
  Half the time these emails come from donotreply@domain.tld

morelikeborelax 9y ago

I have the same issue, except I have a 6 character nickname using 3 unique characters at gmail and people use it for all sorts. Games, flights, utility bills, shopping sites, phone contracts, dating sites and much more. From all over the world. I had someone else's dropbox too, and even after the continued warnings they would cancel it and had cancelled it there were messages to access it still, that it was still there with the ability to view data. The strangest by far though is the huge amount of gmail accounts created with my email as the backup. I have to assume that wording on some localisations indicate you need one so they mash the keys and pop in my gmail. So I have hundreds of security alerts for recovery and notifications it has been set. Funny old world.

dnr 9y ago

Same here. I have a six character gmail address which includes a common name, and I get an average of between one and two misdirected emails a day, sometimes more. Stuff from all over the world, signup emails, invoices, love letters, confidential documents, etc. Mostly the non-dot version, but sometimes a version with one dot. It's infuriating, but I couldn't possibly change my email address at this point; it's tied to hundreds of accounts :(

bluehatbrit 9y ago

Same with me, I have someone who is in the US (I'm in the UK) who has registered for a university and attempted to buy a car using my email address. They must be fairly disorganised as I keep getting emails about overdue library fees. No matter how many times I email these places, they never remove the email from their system. I'm hoping GDPR might give me a hand with that, though I'm doubtful if they're places like a US University. Email validation is a must for all services, people make mistakes and clearly some people don't even know their own email address. This is a problem with both Google and Netflix. Netflix are being negligent and Google should retire this feature.

jjeaff 9y ago

I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in. Then they can never access the account and continue to to use the service. Where available, I will delete the account as well. I found that if I don't do this, then I am just going to be receiving notification emails forever from that account.

BoorishBears 9y ago
If this was me and it was happening often enough to be such a nuisance I had to hijack people’s accounts, I’d just get a different email. Mind you, I’m saying you should have to give up your email because other people have trouble spelling, just stating how I’d handle it.
- jedberg 9y ago
  I've had my gmail address for 14 years now (to the day actually). There is no way I'd give it up because of some morons.

__david__ 9y ago

It's funny, saying "email doppelgangers" reminded me that I have the same issue with phones and physical addresses (but not email since I use a unique domain name). I get multiple snail mail bills for DirecTv to people with different names but my address. One of them apparently didn't pay, so now I'm also getting collections letters addressed to them at my address. I've also had someone in Oregon use my google voice number at some doctor's clinic, so I was getting voice mail transcriptions about appointments and certain tests that needed to be run. Turns out lots of people just can't figure out their own unique ids, whether they're email, phone, or home address.

Splines 9y ago

> If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address. This happened to me - someone registered an Uber account with my email address. So I password reset it and now I have an Uber account for no good reason.

lagadu 9y ago

One of my emails is a "one name" gmail address so I get a few of these fairly often. I've tried doing the good thing where possible and trying to get it changed by contacting the provider but I just gave up. If I get more than a couple of emails from any account, I just hijack it permanently; I've found that deleting the account will only lead to the offender recreating it.

artofcode 9y ago
I have the same issue, but Uber has 2FA on the account through SMS. This way I can't login to cancel the account, and there is no 'unsubscribe here' link in the emails. Also had someone use my email to sign up to an airline. After messing with the seat assignment and meal selection a few times it became old and customer service didnt know what to do, so I changed the associated email to 'helpdesk@airline.com' Even funnier was how a gameshop website that I did have an account with actually changed my password and account details to be assigned to someone in another country. No notifications etc... So now there are a bunch of trade-in credits on my account, after changing it back to my own details.

simooooo 9y ago

I have one of those too. Who has signed up to the world's most persistent architecture and industrial construction email lists.